Rooted! Went down a rabbit hole after getting initial foothold which cost me a day of wasted effort, but woke up this morning and remembered to go back to basics, and then it all fell into place. Got a bit hung up looking trying to shift user identities, until I realised I didn’t need to to get user. Once you get user, root is like 3 mins more work.
My advice - don’t get ahead of yourself thinking you’ve got it in the bag once you get the initial exploit - you still need actual user creds to get the flags.