If only I had seen this first:
Plone FAQ: How do I add a Role?
Here's a slightly more detailed how-to:
- At top level of your site's Zope Management Interface (ZMI), create the new Role in Security tab.
- Also in the same level of the ZMI, edit /acl_users/portal_role_manager by adding the new role (and make sure the name matches from step 1!)
- In Plone's site setup : Users and Groups Administration : Groups, you'll now be able to assign the new Role to a group.