They don't. Sovereign cloud in EU has been progressing for a few years now.

Such that some of your mentioned "unbeatable" hyperscalers have already been positioning (e.g. ceasable infrastructure), and some interesting new players on the block. As well as old benefiting from the related market positions: https://www.oracle.com/cloud/eu-sovereign-cloud/

they are not sovereign because they're running software developed by a company liable to coercion by the regime

Doesn't matter if it is a EU subsidiary. The US parent company must abide by US law and give US authorities the data.

EU citizens cannot trust their data in the hands of US companies. No matter if it is on servers in Europe hosted by European subsidiaries.

So the US legal system can say "give us this data" but they don't have access as they are on another company's servers in another company's data center operated by another company's staff.

US institutions don't hesitate to demand their companies to implement secret backdoors in their hardware or software, as evidenced by Snowden's leaks (for Cisco routers) and the Lavabit shutdown (mail company ordered to implement a tap on their clients' data).

Sure, you can have all you described, but how are updates vetted?

But that is adversarial and is to be expected.

At least for these sort of cooperative partnerships that I am aware of in enterprise, there are typically provisions in contracts for code-access, verifiable builds, ability to reject updates and so on and so on. I don't know if these provisions exist in the sovereign cloud contracts that the cloud companies are building, but I would be really surprised if they went to all this trouble replicating Azure/GCP/etc in entirely air-gapped data centers with duplicated staff and hardware and all that, but don't bother to vet the code they get!

These sovereignty products I don't think are just a check-box you can tick to get it, they're separate things and probably cost the earth too.

Only officially public one that I know of: e.g. https://www.s3ns.io/en (but I hear whispers of others)

The EU should really fight these illegal circumventions

Unfortunately critical infrastructure providers flock to that, though there are some exceptions.

I think you underestimate what a capitalist system can accomplish, and how quickly.

It's a cute little badge that does very very little to address the real concerns.

Just last month, I had to change my dedicated server provider and was genuinely concerned about hosting my websites on US-based entities. Would Trump impose a tariff to antagonize my country and president? I don't have the resources to keep changing providers and migrating my services.

I ended up hosting locally.

It's even more absurd to suggest that this can be done in response to the US becoming more hostile than they are today. By the time they are more hostile, we're talking about open hostilities. It's only safe to assume that they will have exfiltrated all the data they are interested in, and then sabotaged or destroy as much of the hardware as possible (as can be done remotely), making the data center next to worthless. And prior to nationalization it was "their data-center", they were entirely within their "rights" to sabotage and destroy it.

The time to migrate away from data-centers to minimize geo political risk is now, not when the current data centers operators are actively trying to deal damage.

I have not looked at the US-EU agreement.

You don't need an agreement.

Tthe EU commission has tried to create schemes bypassing the issue, and twice they were dismantled by the EU supreme court.

To obey local laws

The USA is going "unlawful", so the risks are technical and real. Local laws do not apply

But long before that, I believe there will be other noticeable effects. As someone working in a medium sized European company, with substantial investments across private infrastructures, AWS, GCP and some Azure, I can testify to that since last couple of weeks the Public Cloud Exit strategies around having services being prepared is a very hot topic. This concerns both existing services preparations as well as enforcing standards and configurations for new services.

the enemy will never put you into a position where the rational thing to do is to launch your nukes (nationalise their data centres)

but they will push and push up against that line

the way to deal with this is gradual decoupling, ideally backed up by legislation and government subsidy

The reserve status is overblown. The question is if not the USD what asset would reserves go into. Certainly not the yuan with china's currency controls.

I see the point. But I would not underestimate the grit of Europeans when backed into a corner, like this

The USA a Europe had very friendly relations for decades, that has changed overnight.

All bets are off