apparmor_parser --skip-read-cache --write-cache -r /etc/apparmor.d/ should do that. ("Should" because I didn't test it - but the manpage explicitely recommends this combination.)
An easier-to-remember way is to touch /etc/apparmor.d/$whatever which will also rebuild the cache for profiles including this file when the profiles get reloaded next time.
Thanks for that info, I've made note of it.
That said - not shipping the precompiled cache is the easiest way to avoid problems like yours. I changed the package so that it doesn't include the precompiled cache for Tumbleweed anymore (SR was accepted yesterday, will be included in one of the next Tumbleweed snapshots). The only disadvantage is that booting after a major kernel update (with a new AppArmor feature hash) will need some additional seconds to build a new cache. (Updates of the apparmor-profiles or apparmor-abstractions package will also build a new cache, but that gets done after package installation.)
Excellent! I cannot imagine it takes that long to build the new cache.
For a more detailed (and summarized) description, see boo#1205659
Thanks for submitting that bug report. I just read it and see the long term solution which you mentioned is on the TODO list upstream. Personally I like your idea of not including them that way whenever a new kernel or apparmor profiles are updated they are rebuilt.