[codex] Verify honey canary binary provenance

[Jesssullivan]

Summary

• Propagates honey canary binary provenance guards into the SSH run command.
• Records and optionally checks the honey tcfs binary SHA-256 in honey-linux-xr-shadow-run.sh.
• Extends the home-canary helper regression to assert version and SHA guard wiring.

Why

The next linux-xr shadow canary must not silently use honey's ambient stale tcfs from PATH. The previous helper generated a version guard in the remote script, but did not pass the expected-version env through the actual SSH command. This makes the guard enforceable and adds a hash check for a pinned honey Linux binary.

Validation

• bash scripts/test-home-canary-linux-xr-shadow.sh
• bash -n scripts/home-canary-linux-xr-shadow.sh scripts/test-home-canary-linux-xr-shadow.sh
• shellcheck scripts/home-canary-linux-xr-shadow.sh scripts/test-home-canary-linux-xr-shadow.sh
• task lazy:check
• git diff --check
• git diff --cached --check