Rooted! What a ride this box has been. Thanks a lot @ale98 for the nudges that helped me get there.
Some general guidance for once you get a shell: Windows Defender is watching. Try to think about how you can cleverly get files onto the box - smb may help, but impacket-smbserver may not be enough. As always, netcat is a lifesaver - in more ways than one…
Feel free to PM for nudges!