As with many new package components, I test everything in throwaway packages and only rely upon the behavior I can document. For that reason I can answer some, but not all, of your questions. I highly recommend testing with throwaway packages if you have finer-grained questions to which I don't have answers!
Can I put PermsetGroups in Base and have Extensions add Permsets and CustomPerms?
Point of clarification: PSGs do not themselves contain Custom Permissions, but you can add PermSets to them that do.
Extension packages cannot package changes, such as adding a PermSet, to PSGs owned by base packages.
Can PermsetGroups in Extension re-bundle Permsets and CustomPerms?
I believe your question is asking whether Extension PSGs can include PermSets owned by Base packages.
I do not know the answer to this question but will try the experiment in my throwaway packages and update here.
Does the overall behavior differ between 1GP and 2GP Packages with a shared namespace?
I do not know the answer to this question.
Can Subscribers of the Base+Extension add, remove from packaged PermsetGroups or Permsets?
Subscribers can add PermSets and Muting PermSets to managed PSGs. These subscriber changes do not impact, and are unaffected by, your package upgrades.
Subscribers cannot remove packaged PermSets from packaged PSGs.
A few other things I've learned about PSGs and packaging:
- You cannot change the label of a managed PSG.
- You can push-upgrade addition of a new PermSet too an existing PSG.
- You can push-upgrade removal of a PermSet from an existing PSG (it doesn't delete the PermSet, but removes from the PSG).
- Subscribers can compose your managed PermSets into their own unmanaged PSGs.
- You cannot delete managed PSGs.
- You can add unmanaged PermSets to managed PSGs via the Tooling or Metadata APIs.