Building python-based Mac app with py2app, creating an installer, generates failing installer

Question

This is similar to py2app with native python 2.6, but is different enough that it's still a puzzle.

Environment: Mac OS 10.8 & 10.11, Python 2.7.6, py2app 0.14

I create a Mac application bundle from python, using py2app, on Mac OS 10.8. This seems to work fine. I then build an installer package using pkgbuild and productbuild. That appears to build with no errors, until I try to use the installer to install the package.

I'm running the installer on MacOS 10.11 (it will also have to run on MacOS 10.8-10.13). The installation fails, with the following in the install.log:

Dec 21 15:14:46 Erics-10-11-Mac-VM shove[30757]: [src=nonrestricted] /System/Library/Frameworks/Python.framework/Versions/2.7/include/python2.7/pyconfig.h: unable to remove flag 0x80000 (error 1)
Dec 21 15:14:46 Erics-10-11-Mac-VM shove[30757]: [source=file] failed _RelinkFile(/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/PKInstallSandboxManager/3BE46873-2E16-4787-81A4-335FB1DCB67B.activeSandbox/Root/Applications/MyApp.app/Contents/Resources/include/python2.7/pyconfig.h, /System/Library/Frameworks/Python.framework/Versions/2.7/include/python2.7/pyconfig.h): Operation not permitted
Dec 21 15:14:46 Erics-10-11-Mac-VM shove[30757]: srcPath = /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/PKInstallSandboxManager/3BE46873-2E16-4787-81A4-335FB1DCB67B.activeSandbox/Root/Applications/MyApp.app/Contents/Resources/include/python2.7/pyconfig.h NSFileOwnerAccountID=0 NSFileHFSTypeCode=0 NSFileSystemFileNumber=1025119 NSFileExtensionHidden=0 NSFileSystemNumber=16777219 NSFileSize=36515 NSFileGroupOwnerAccountID=0 NSFileOwnerAccountName=root NSFileCreationDate=2017-12-21 20:12:33 +0000 NSFilePosixPermissions=420 NSFileHFSCreatorCode=0 NSFileType=NSFileTypeRegular NSFileGroupOwnerAccountName=wheel NSFileReferenceCount=1 NSFileModificationDate=2017-12-21 20:12:33 +0000

The issue seems to be that the installer wants to copy (or do something with) Contents/Resources/include/pyconfig.h into /System/Library/Frameworks/Python.framework... but that operation is not permitted. It's presumably not permitted due to the MacOS System Integrity Protection on /System/.

This raises a couple of questions:

1. What exactly is the installer trying to do by copying pyconfig.h into a System directory (which is expressly prohibited?) Besides, there's already a pyconfig.h there.
2. What can I do to fix this? Somehow tell py2app not to put pyconfig.h in the include folder? Tell the installer to not copy it into the System folder? Is there a workaround? Disabling SIP is not an option.

Note that I'm constrained to build on MacOS 10.8, and install on arbitrary systems from MacOS 10.8 - 10.3.

Any and all help is appreciated.