I think GoGuardian is normally full device, but on Chromebooks it is installed via extensions. Extensions in on Chromebooks are 'user' policies so they are applied to entire OUs of users. (docs here for anyone who is interested : https://support.google.com/chrome/a/answer/6177431?hl=en#zip...)
These types of solutions are really common for schools because under CIPA you must filter your network to receive e-rate funding. Deploying it to the device meets these requirements and also extends filtering off site which is a commonly requested feature.
If it is just being managed at the user level - then creating a second account is exactly the way to go.
I work for a school district (not CPS) with about 2000 deployed Chromebooks and you're likely running into one of two things.
1) You somehow 'enrolled' the device into the Chromebook management. This is hard to do by mistake but if you do, essentially puts the device under the control of the school district. It also uses up a license on their end. We only allow particular IT only accounts to enroll devices.
2) You're logging in with their CPS account. Once a person logs in with their managed account it can deploy user level policies that include everything you described: extensions, filtering, and blocking signing into another account in the browser. You'll also find some random pages are blocked to keep students from bypassing the restrictions.
That you can wipe the machine makes me think you didn't enroll it - if you wipe an enrolled device it will prompt/force you to re-enroll.
You should be able to reboot the device so you land at the login screen and hit "Add Person" down at the bottom. From there sign in with a different Google account and it should be completely unaffected by any policy the school is deploying. Unless you enroll it, the policies are deployed to the Google account, not the device.
Its likely the CPS Help Desk Staffer you reached doesn't have the power to fix things for you if you've enrolled things - that usually requires permissions that are restricted to a few admins.
Feel free to shoot me a message via the email in my profile - I'm happy to give you some of the inside perspective and help you figure it out.
These types of solutions are really common for schools because under CIPA you must filter your network to receive e-rate funding. Deploying it to the device meets these requirements and also extends filtering off site which is a commonly requested feature.
If it is just being managed at the user level - then creating a second account is exactly the way to go.