It turns out Windows (10) accepts unicast router advertisements directed at the virtual address of an IKEv2 interface, and doesn't need a link local address for this to work.So, I just have an updown script like yours add the client's virtual IPv6 address to a clients{} block in /etc/radvd.conf, using stock (Ubuntu) strongSwan on the server.