> The capsicum diff [to tr] required the following ...

This is a slightly out of date example. We've since added simplifying wrappers for stdio.

The current equivalent of if pledge("stdio", ...) / err is:

    if (caph_limit_stdio() < 0 || (cap_enter() < 0 && errno != ENOSYS))
      err();

Some examples: https://reviews.freebsd.org/D8307

> a "work or die" usage model

This is an option (or will shortly become an option) in capsicum.