Finally - with (very patient) help from @0x41 and @d3spis3d
I made things harder than they needed to be but also learned something new in the root privesc part.
Happy to help others via dm