OK, I got this working with two Unos:
The lower Uno has its low-fuse set to 0xBF, which sends the buffered clock signal to CLKO (pin 8 ).
The upper Uno has its low-fuse set to 0xE0, which configures it to receiving an external clock on XTAL1 (orange wire).
NB this does not work if you connect master-XTAL2 to slave-XTAL1 -- probably because the clock is programmed for a low-power crystal which generates a low-amplitude signal. If configured for a full-swing oscillator it may not be necessary to use CLKO (freeing up pin 8 ).
Apart from the low fuse both Unos are configured identically and run Optiboot v4.5. The two reset pins are wired together to ensure synchronised startup, although the start of the slave Uno is delayed for reasons I don't fully understand.
To check the relative clock stability I ran pulse generators on both Unos and monitored the output on an oscilloscope. For comparison I then re-separated the clocks and ran the same test.
Synchonised clocks, right after startup:
Synchonised clocks, after 10 minutes:
Un-synchonised clocks, right after startup:
Un-synchonised clocks, after 10 seconds:
Un-synchonised clocks, after 20 seconds: