So it has taken far too long to get this done. As our migration operations were tightly coupled to South migrations, South was holding us back for far too long. Today I've pretty-much finished the migration. I wound up embedding a virtualenv inside the firmware for each product that has stub packages, the south migrations, and (just) the modules that the migrations use. That virtualenv's entire purpose is just to run the South migrations to completion, at which point the Django migrations do a fake migrate and a flag is set and we no longer run the South code. Each product can then drop the South virtualenv at the point where all machines are upgraded or we are willing to require a "migrate to X before any further migration" restriction.
All that's left to do is to try it on real machines instead of virtualenvs :D .