You'll need a single DNS request, known as a "bootstrap" request. Your ISP will see a single DNS request to Google or Cloudflare or whatever, then everything after that will just look like normal https traffic.

That said, if your ISP is blocking and denying ALL dns requests for some reason (making the bootstrap request impossible), then you could still define the address locally. At that point, though, the ISP is likely blocking the IP addresses, too, so resolving the address is a bit moot.

Yes you'll need a way to query the domain of the DoH service in plaintext before using it. In many software you can define "bootstrap DNS addresses" to do exactly that. Or you can hardcode the DoH service's IPs, which for most upstream providers are almost always the same as their "normal" IPs anyways

You define your dns by IP. you get the cert from that IP and automatically trust it.

The cert for validation the server only validate the hostname. It's not useful for IP.