The binary cache is per-profile: it's not a monolithic thing that either
entirely valid or not. So any additional AppArmor profile shipped by Additional
Software is compiled at postinst time, regardless of whether the cache for the
policy we ship by default was loaded from the USB stick or generated from
scratch at boot time.