v1.21.0: Per-template notifications and approval risk

Templates and individual runs can route their notifications to their own destinations. Each run waiting for approval now shows a plain risk grade, so approvers see the blast radius before they sign off.