So the part being programmed does not need a xtal at all?
If the chip is fresh it is already set to use the internal RC clock. If you are re-using a chip you are supposed to supply a clock signal. You can set an
Arduino timer to toggle a data pin at 8MHz and connect that to the XTAL1 pin of the target chip.
The SPI interface is supposed to be run at no faster than half the processor clock (assuming a processor clock <12MHz). I'm not sure if the default clock counts as 8MHz (the raw speed) or 1MHz (the speed after the pre-scaler). Probably best to assume 1 MHz. An SPI speed of 512 KHz (SPI_CLOCK_DIV32) should be safe but for extra margin, try 256 KHz (SPI_CLOCK_DIV84) ,