Upgrading to beowulf will be the best, then. Are there any unconfined processes left?

I've now changed the profile definition line from

profile dhclient /{usr/,}sbin/dhclient

to

profile /sbin/dhclient

Which results in progress:

0 profiles are in complain mode.
2 processes have profiles defined.
1 processes are in enforce mode.
   /usr/sbin/nscd (1899) 
0 processes are in complain mode.
1 processes are unconfined but have a profile defined.
   /sbin/dhclient (880) 

I have both apparmor-utils and dh-apparmor.

What I just did was install NSCD and what do you know:

43 profiles are loaded.
43 profiles are in enforce mode.
...
0 profiles are in complain mode.
1 processes have profiles defined.
1 processes are in enforce mode.
   /usr/sbin/nscd (3725) 
0 processes are in complain mode.
0 processes are unconfined but have a profile defined.

I also just did dpkg-reconfigure apparmor.

The "0 processes are unconfined but have a profile defined." line suggests that everything other than nscd does not have a profile at all. Which means I need to get more profiles somewhere.

And indeed, a short excursion into /etc/apparmor.d reveals that there aren't many profiles present.

There is, and:

cat /proc/cmdline
BOOT_IMAGE=/devuan/root.subvol/boot/vmlinuz-4.9.0-6-amd64 root=UUID=d7e92d18-e57a-4d4a-9f7e-e9301fa4c16e ro rootflags=subvol=devuan/root.subvol quiet apparmor=1 security=apparmor

I have updated the config, my initial one missed deb.debian.org (see amprolla rewrites).

I don't like the @ naming convention for subvolumes as the @ has to be escaped in shell. Instead I give these directories the .subvol extension.

Choose expert install, proceed up to and including partitioning. Finish partitioning normally, choosing luks,lvm,btrfs or whatever. Then:
- go to another terminal (alt+f2)
- find the btrfs filesystem device in output of # mount   (in my case it is at /dev/vg_devuan/main)
- # mkdir /tmp/target
- # cp -ar /target/* /tmp/target
- # umount /target
- (Add --mixed if device is under 5 GB or so) # mkfs.btrfs -f /dev/vg_devuan/main
- # mkdir /rv
- # mount -o noatime,compress=lzo,nossd,autodefrag,space_cache=v2 /dev/vg_devuan/main /rv
- # btrfs subvol create /rv/devuan/root.subvol
- # mount -o noatime,compress=lzo,nossd,autodefrag,subvol=/devuan/root.subvol /dev/path/to/btrfs/device /target
- # cp -ar /tmp/target/* /target
- (optional, if you are low on RAM) # rm -r /tmp/target

Now go back to the installer and proceed at the "Install base system" step.

Disregard the above, it results in the "Install base system" hitting
"Error: apt or in-target already running" and I do not know how to resolve it.
So, just complete the install normally, without compression or subvolumes,
we'll deal with that later.
This is does not happen any more.

Complete the install and reboot. When it reboots, login as root only and do the following:
- # mkdir /rv
Edit /etc/fstab, and change it to resemble the following (Note: the nossd flag is there because the ssd allocator has some issues on kernels <4.15 or some such):

 /etc/fstab: static file system information.
#
# Use 'blkid' to print the universally unique identifier for a
# device; this may be used with UUID= as a more robust way to name devices
# that works even if disks are added and removed. See fstab(5).
#
# <file system>            <mount point>   <type>  <options>       <dump>  <pass>
/dev/mapper/vg_devuan-main /               btrfs   defaults,nossd,compress=lzo,noatime,subvol=/devuan/root.subvol 0 0
/dev/mapper/vg_devuan-main /home           btrfs   defaults,nossd,compress=lzo,noatime,subvol=/devuan/home.subvol 0 0
/dev/mapper/vg_devuan-main /rv             btrfs   defaults,nossd,compress=lzo,noatime,subvolid=5                 0 0

tmpfs                      /tmp            tmpfs   defaults                                                       0 0

/dev/sr0                   /media/cdrom0   udf,iso9660 user,noauto                                                0 0

The /tmp line is optional.

- # mount /rv
- # btrfs subvol create /rv/devuan/home.subvol
- # cp -ar --reflink=always /rv/devuan/root.subvol/home/* /rv/devuan/home.subvol
Remember the --reflink=always parameter, it makes cp do a shallow copy on btrfs (same files underneath, copy on change). You might want to put that into bashrc as an alias: alias cpref="cp --reflink=always.
- # rm -r /home/*
- # mount /home

Reboot for the new mount flags to take to effect. Now it should work as intended and the output of # mount  should reflect that.

EDIT 2020.05.10: Changed 16GB->5GB to be in line with btrfs recommendations. Added space_cache=v2. Changed rootfs.subvol to just root.subvol
Note: if you get stuck on the first boot, ctrl-c will unstuck it and land you at login. If you further cannot remount / rw, then also specify the device on the command line. Seems to happen if no lvm/luks is used, as the above reformat step will change UUID.

I will amend this post with further fixes, should any problems arise.