After a lot of fiddling to avoid needing to recompile for 45 minutes to modify the executable bit on init_sh I have switched root and have a shell inside my rootfs.img:
# exec switch_root /media/root/ /sbin/init_sh
======================= Running second /init
Starting second shell
# ls
var tmp srv run proc mnt lib64 etc data bin
usr sys sbin root opt media lib dev boot
# ls /dev
shm pts log
# mount -t devtmpfs -o rw none /dev
mount: permission denied (are you root?)
# whoami
sh: whoami: not found
# id -u
1000