rel=canonical is just a suggestion, but it is a strong suggestion. Google would certainly honor it in a situation like this. Other search engines might not do so very well. I use rel=canonical to keep development servers from being indexed even when they are publicly accessible. Googlebot will still crawl the entire site on my development server, but it won't actually index it.
For anything else to work, you will need to be able to have some difference in the code between the two sites. You could serve two different robots.txt files. You could use .htaccess and mod_rewrite to choose the correct file for the correct domain. Here is a blog entry that walks you through the mechanics of doing so: http://blog.cherouvim.com/robotstxt-control-for-host-aliases-via-mod_rewrite/
Alternately you could put a meta noindex tag on the pages of the new site. I don't know what software powers your site, but it could be possible to modify it so that you just noindex just the new site. For example, if you site is powered by PHP, you could put the meta noindex inside a statement like
if ($_SERVER['HTTP_HOST'] == 'new.example.com'){