Is Bitcoin PoW actually SHA256 + Merkle generation? Or have I misunderstood coinbase/append?
You are correct that effectively Bitcoin PoW involves computing the Merkle root every now and then in addition to the hash grinding.

However, this is negligable. Even ignoring nTime rolling, the Merkke root computation is just a dozen or so hashes every 232. It's so little because not the entire Merkle tree needs recomputation; just the coinbase transaction is modified, along with n Merkle nodes above it (assuming up to 2n transactions).

As far as I know, the burden of Merkle root computation is so low that it is generally done in the miner controller rather than in the ASIC itself.