But in this case google.gh would have to be "HSTS'd", but preloaded in the browser to only accept EV certs?

Otherwise the attacker could just mint a non-EV cert, right?

EV certs went away because no user checked if the URL bar had the extra flair.