Ajay,
Regarding your first question: even though I have no experience whatsoever with the Client Auth SDK, I don't think it is possible. By using only one UI for the sign-in process of various applications, the end-user is always seeing a similar dialog, thus creating trust. The dialog also tells the user who created the application, that it is not made by Microsoft. It can also access the local credential store, which provides the user with the convenience of remembering usernames and passwords, like Messenger and the Sign In-assistent offer.
When signing in, the module encrypts the credentials received from the form, negotiates with the Live ID-server and finally authenticates the user by returning a user ID or something similar. There are some security measures (like encryption) in place that are used before the authentication request is handed off to the Live ID-servers. If you could implement all this yourself, that would mean a security breach as Microsoft has to hand off their secret keys (used for encrypting and decrypting the server message), which is unwanted as it would risk the entire security model of Live ID. Also, it would mean you would have to implement a lot of error checking and exception-handling, which can be tricky.
Basically, you are planning to reinvent the wheel. But instead of using the perfectly round one that everybody uses and trusts, you're creating a square one of what you keep chipping pieces off until you reach a point where it is roundish, but still doesn't perform as good as the other wheel does.
Regarding your second question: when you click the mail or Spaces-button in Messenger, a temporary file is created containing a form that is submitted to the Live ID-servers, which contains things like the user's ID, the requested return URL, etcetera. When the browser launches, this form is submitted to the server, which handles the authentication request and redirects the user to the given URL. Only at that time the user is web authenticated.
So, if you would delete all your cookies and profiles and temporary files (basically create a new profile) and then sign in to Messenger, but do not click a mail or Spaces-button, but then browse to www.hotmail.com, you are asked for your username and password (assuming the Sign In-assistent is not active) even though you are logged in in Messenger. This is due to security measures put in place by your browser.
I don't know if there is a possibility to create a similar experience using the Client and Web Authentication SDK's, my guess is it is not possible as it would bypass the security warning that Web Auth gives ("This site is not affiliated with Microsoft, blablabla").
I hope this answers your questions, let me know if there is something unclear about my reply 
Alex
I think the Live ID-team has made a better decision on getting credentials from a user than the Live Contacts-team. I could build a Live ID-clone using the Contacts API to verify user credentials... while that's impossible with the Client SDK/Web Auth SDK. If you really want to use a custom Sign In UI, you could (mis)use Live Contacts... but I'd advise you to use the supplied Client SDK with it's UI.