pledge() wasn't intended for our awesome sandboxing tool? Well that just goes to show how brilliant the OpenBSD developers are, that folks like myself are finding great uses for their ideas and design that they didn't intend. We might not be able to live up to OpenBSD's model given the way Linux is, but I do believe we're going to have a better and more secure Linux thanks to the influence of OpenBSD.
OpenBSD pledges aren’t normally used for child processes, they’re more for “okay this program has super well-defined needs, let’s make sure (in its own source code) that it won’t be able to do anything else”. So a wrapper program wouldn’t really be normal usage.
