So far I haven't been able to think of a solution to the "clone your hard drive" attack. How does a single instance of data know that it has been copied?

It doesn't. hence: proof of work. A better direction would be thinking of how to irreversibly imbue data with the PoW. When I thought about that a little, I ended up with: you have to have an entire compute stack that respects PoW-imbued-data and only talks to other computers that do the same. And then I walked away from the idea because I realized it was just Urbit/Plunder/OPFN/doomed again.