Cellebrite app left on phone after police seized it, rookie mistake?

No, there is no risk. Cellebrite is designed to be accessed locally, what you have is an agent which uses zero day to achieve superuser status. It possesses no ability to phone home. Cellebrite is designed to wipes syslogs that would reveal the method of achieving root level access, so you will not discover anything by sending your phone to someone.

Neither your phone or laptop are compromised because Cellebrite does not offer this service nor would it be legal in your situation. If someone wanted to compromise your device, they would do it without taking it from you in the first place, and they would not bring a search warrant/