Not a single guess? Ah, well.
Turns out the culprit in this case was a client-based firewall, the Network Threat Protection module of Symantec’s Endpoint Protection software. Apparently it protects clients too well over IPv6, but cutting them off entirely. Once it was disabled, DHCPv6 and IPv6-based name resolution began working.
