Found it. "Profile View Access Level" setting in CB Configuration, where I had already done a careful field-by-field check to the production site. I think the technical term for this is "oops". The upgrade to CB 2.0 does surprisingly change a few settings that are sort of important, and I missed that one.
My bad. Thanks again.