For other people confused by this:
Unfortunately, not all packages work with the pure-capability (memory safe) ABI. In particular, things that can’t be compiled with clang don’t. CheriBSD is set up to with two pkg variants, one that installs pure-capability packages and one that installs AArch64 ones. The default pkg command is removed to make this explicit so you know exactly what you’re getting (though you can symlink pkg64c or pkg64 to pkg if you want).
Of we get the CheriBSD things upstreamed, I’d like to have a fallback mode for pkg that installs from a second ABI if the first is not available for the entire dependency graph. This would probably have been necessary already if pkg had been available early in the 32 to 64-bit transition.