Task notifications are currently based on User Task Deadlines so you need to fill in details of the notification on task level (like you mentioned not-started, expires at, etc). Notify attribute is not bpmn2 attribute and there is no such custom extension either in jbpm 5.
To map user/group names to email addresses use one of available out of the box implementation of UserInfo class that needs to be set on deadline handler class. See some details here.
I believe 5.4 is production ready.
HTH