Finally rooted the ■■■■ thing. After trying to do it the “intended” way for too many hours I got grumpy. Using my initial foothold I popped a service account and used it to get a SYSTEM shell. From there I just snagged the identity I needed and grabbed the root-flag using it.
Looking at the stuff running it’s obvious why I couldn’t slip my stuff in the way I intended, the “upstream processing” would only be built that way by someone completely insane 