I've been reading through the docs for Gmail Contextual Gadgets and I can't find information on whether or not a private gadget can be deployed to a specific OU or it has to be turned on for the entire org. It seems like you can do this if you publish your gadget to the Marketplace, but in our scenario the gadget may not provide enough functionality to qualify as a Marketplace app.
The Google Apps Extensions console only allows you to deploy a gadget to the entire domain. As you mentioned, using the Google Apps Marketplace you can limit an app to only certain OUs. You can publish your marketplace app as private to your domain, if you don't want to share it with the whole world.