make edit tab available for those with the right permission

Maybe as simple as this (untested)

  $items['country/%country/view'] = array(
    'title' => 'View',
    'type' => MENU_DEFAULT_LOCAL_TASK,
    'weight' => -10,
  );
  $items['country/%country/edit'] = array(
    'title callback' => 'countries_page_title',
    'title arguments' => array(1),
    'description' => 'Edit a country.',
    'type' => MENU_LOCAL_TASK,
    'page callback' => 'countries_admin_page',
    'page arguments' => array(1),
   // Custom permission??
    'access arguments' => array('administer site configuration'),
    'file' => 'countries.admin.inc',
    'file path' => drupal_get_path('module', 'countries'),
  );

I would indeed opt for a custom 'admin country page'. OTOH what if country == og node?

custom 'admin country page'

This is just a menu item pointing to the existing admin page, not sure if this is what you meant by custom.

OTOH what if country == og node?

This will probably will not integrate directly :(

I've added new permission and needed hook_form_alter to redirect back to country/%country

Should we restrict edit to enabled countries same as view?

function country_page_view_access($country) {
  if ($country->enabled || user_access('administer site configuration')) {
    return user_access('view country pages');
  }
  return FALSE;
}

I can imagine editing a disabled country makes sense for a site editor.

Maybe it is worth doing an access callback to keep things simple?

function country_pages_access($op, $country) {
  switch ($op) {
    case 'view':
      if ($country->enabled && user_access('view country pages')) {
        return TRUE;
      }
      return user_access('administer site configuration');

    case 'update':
      return user_access('edit country pages') || user_access('administer site configuration');

    case 'delete':
       // Countries defined by Drupal can not be deleted.
       if (country_is_locked($country)) {
         return FALSE;
       }
       return user_access('delete country pages') || user_access('administer site configuration');
  }
}

Feel free to add delete support, but albeit I am not sure how well this will work, i.e. again the redirects to consider (x2). Maybe worth it's own ticket.

  $items['country/%country/delete'] = array(
    'title' => 'Delete',
    'description' => 'Deletes a Country.',
    'page callback' => 'drupal_get_form',
    'page arguments' => array('countries_admin_delete', 1),
    'access callback' => 'country_pages_access',
    'access arguments' => array('delete', 1),
    'type' => MENU_LOCAL_TASK,
    'file' => 'countries.admin.inc',
    'file path' => drupal_get_path('module', 'countries'),
  );

Added #2472199: Add delete operation to country

Attached patch implemented the central access function.

I'll commit this as I assume no further issues with this.