Rooted! Took me far too long to find the initial vulnerability as I was looking in the wrong places. The vuln is much more recent and didn’t turn up in initial searches!
For root enumerate and go back and do something you may have tried at the start. They aren’t the same… from there its straight sailing.