RISC-V could be a pretty good ISA, if only it came with a popcount instruction. Given popcount, it is easy to compose a whole range of other essential operations with just one or two more instructions. Without, you are stuck running two dozen instructions just to get to the first step.

Is the RISC-V evolutionary process capable of processing small-sized, incremental improvements? Or are only big "extension" instruction families even possible?

The B extension is going to add that.

https://github.com/riscv/riscv-bitmanip

Also conditional move which you really need for a lot of reasons but especially to avoid timing attacks in cryptography.