And you're right, according to their changelog [1], they added it in 11.3.
>> v 11.3rc1 + Contextual policies (different capabilities for the same origin, depending on the top-level domain) configurable in the CUSTOM panel (thanks NLnet for financial support)
Woohoo!
Thanks for following up and making me look, I now have a better setup!
Edit: seeing your edit - the plot thickens. I'm on 11.4.4 - any difference there?