Assign user roles but not permissions as ability for site managers in Drupal 8

… am i sort of asking for the opposite of my own old https://www.drupal.org/project/pwn ?

Not really; the goal is much the same (let a user give out permissions they themselves have) but not as fine-grained (give out entire roles that they have, or are configured as ones they can grant, so presumably not greater in power than their own role).