I copied the site into a test environment and removed all the overrides, and then set the modules to use the default templates. The k2 content modules continued to serve up URLs in the non-SEF format. Then I updated K.2 to 2.9.0, and they still served the URLs in the non-SEF format.

I installed sh404SEF and the K2 plugin, and everything seems to work fine now, even with the overrides restored. There may have been some other system customization in play, but my firewall software didn't detect any changed Joomla core files.