### Is there an existing issue for this?

- [X] I have searched the existing issues

### Current behaviour

I randomly encountered this by loading a wallet created from master with an older version. I could trace it down to bd13dc2f46ea10302a928fcf0f53b7aed77ad260 (#26076), but I don't know descriptor wallets enough to understand what's going on (cc @Sjors @achow101).

### Expected behaviour

`bitcoind` starts, or at least tells me to use a later version if #26076 was a breaking change instead of corrupting `wallet.dat`.

### Steps to reproduce

(master, clean chain): 
`createwallet -regtest ""`
(v25.0rc2):
first `bitcoind -regtest` succeeds
then stop and restart the node: The second `bitcoind -regtest` leads to an InitError:
`Error: Error: Unable to expand wallet descriptor from cache`
now, the wallet cannot be loaded by either version.

### Relevant log output

_No response_

### How did you obtain Bitcoin Core

Compiled from source

### What version of Bitcoin Core are you using?

v25.0rc2 / master

### Operating system and version

Ubuntu

### Machine specifications

_No response_
SignatureData sigdata;
        input.FillSignatureData(sigdata);
        std::unique_ptr<FlatSigningProvider> keys = std::make_unique<FlatSigningProvider>();
        std::unique_ptr<FlatSigningProvider> script_keys = GetSigningProvider(script, sign);
        if (script_keys) {
            keys->Merge(std::move(*script_keys));
        } else {
            
            std::vector<CPubKey> pubkeys;
            pubkeys.reserve(input.hd_keypaths.size() + 2);
            
            for (const auto& [pk, _] : input.hd_keypaths) {
                pubkeys.push_back(pk);
            }
            
            std::vector<std::vector<unsigned char>> sols;
            if (Solver(script, sols) == TxoutType::WITNESS_V1_TAPROOT) {
                sols[0].insert(sols[0].begin(), 0x02);
                pubkeys.emplace_back(sols[0]);
                sols[0][0] = 0x03;
                pubkeys.emplace_back(sols[0]);
            }
            
            for (const auto& pk_pair : input.m_tap_bip32_paths) {
                const XOnlyPubKey& pubkey = pk_pair.first;
                for (unsigned char prefix : {0x02, 0x03}) {
                    unsigned char b[33] = {prefix};
                    std::copy(pubkey.begin(), pubkey.end(), b + 1);
                    CPubKey fullpubkey;
                    fullpubkey.Set(b, b + 33);