As soon as I read that, I realized that my "generic-service" template had "contact_groups admins" defined, which was overriding the host contact_groups.
There is now a head-shaped dent in my desk, and I have a much simpler service configuration file.