Turns out there is already a class 1 SHA-2 intermediate! It's just buried on their site, but you can add it to your chain and it passes SSLLabs validation and otherwise looks totally fine. So this isn't as huge a problem as I had thought.

https://www.startssl.com/certs/class1/sha2/pem/sub.class1.se...