I just tested in lab.
You are correct if you push config only to Active PA from panorama then both active and passive PA shows running config in sync.
Candidate config is not same on both PA.
Whenever we do changes we do on the candidate config.
I checked Panorama shows out of syn for passive PA as this is expected behavior when we only push config to active PA from