IKEv2 establishes a successful IKE SA on both routers, but 'show crypto ipsec sa' shows no child SAs and no encrypted traffic. Which single condition is the most likely cause?

A mismatch in IPsec traffic selectors (crypto ACLs) is the most likely cause. IKEv2 successfully establishes the IKE SA (Phase 1) for secure key exchange, but the child SA (Phase 2), which defines the actual data encryption parameters, relies on matching traffic selectors. If the ACLs on both ends don't define the same interesting traffic, the child SA cannot be negotiated and installed, preventing encrypted traffic flow. Differing IKEv2 policy lifetimes, even by a small amount, would not prevent the initial child SA establishment; it would only affect rekeying. NAT-T being disabled when no NAT exists is a non-issue; NAT-T is only needed when NAT is present. Missing DNS resolution for peer hostnames would prevent the initial IKE SA establishment, which the question states was successful.