Enforce single branding binary in workspace metadata

[oferchen]

Summary

• require the workspace branding validator to assert the daemon binary matches the client binary so only one executable is configured
• cover the new constraint with a focused unit test and update the branding fixture to use the shared binary name

Testing

• cargo test -p xtask

---

Codex Task