Since the merge builder has all the pieces necessary to get the full CDN links for an app cache.manifest, it should be able to use the SHA-1 mappings to resolve the URLs automatically from a simplified app cache manifest. If possible, this file should be generated at compile time by DUEL Merge. Then the file would be permanently cacheable in the CDN. Whenever it or one of its children changes, it would change names. Directly analogous to .merge files.
Ensure the resulting file is served with the "text/cache-manifest" MIME type. It doesn't appear that an official standardized extension exists but convention seems to be ".manifest".
EDIT it appears ".appcache" is the official extension. Perhaps both should be supported.
Excellent overview of the gotchas: