It seems that you can use Drupal's own features for almost all of the tasks you need:
1 - If you give authenticated users create content permissions and you check out the "published" checkbox in your contet types' settings they can create upublished content;
2 - Authenticated users normally have no administer nodes permission, so they cannot publish their own content (or any);
3 - Administrators can do everything they want, provided they have administer nodes permission.
4 - You can set edit own content to authenticated users.
You need one more trick to unpublish content when it is edited. I don't know of any contrib module providing this functionality, but you can easily add it to your custom module, e.g.:
function <YOUR_MODULE_NAME>_node_presave($node) {
if (! user_access("administer nodes")) { // skip if user has admmin permission
$node->status = 0; // unpublish the node
}
}