Google has all the money and technical resources to do something -- if they gave a shit. They don't give a shit -- that should be clear :2 cents:

Not very technical with javascript so maybe somebody can actually type this up. What I was thinking is that use the escape characters to obfuscate what you are doing with the javascript and do this:

1. window.location.hostname - if it doesn't match your domain then goto step 2:
2. insert a noindex <meta name="robots" content="noindex" />

It should be obfuscated so they really don't know what's going on. Some something like this:

<script language="javascript">
if window.location.hostname != '%79%6F%75%72%64%6F%6D%61%69%6E%2E%63%6F%6D
then
document.write(unescape('%3C%6D%65%74%61%20%6E%61% 6D%65%3D%22%72%6F%62%6F%74%73%22%20%63%6F%6E%74%65 %6E%74%3D%22%6E%6F%69%6E%64%65%78%22%20%2F%3E'));
</script>
that js is not correct but maybe somebody can fix it. You can also just obfuscate your canonical like somebody mentioned above. Kind of tricky for lots of pages though.