### Is there an existing issue for this?

- [X] I have searched the existing issues

### Current behaviour

I randomly encountered this by loading a wallet created from master with an older version. I could trace it down to bd13dc2f46ea10302a928fcf0f53b7aed77ad260 (#26076), but I don't know descriptor wallets enough to understand what's going on (cc @Sjors @achow101).

### Expected behaviour

`bitcoind` starts, or at least tells me to use a later version if #26076 was a breaking change instead of corrupting `wallet.dat`.

### Steps to reproduce

(master, clean chain): 
`createwallet -regtest ""`
(v25.0rc2):
first `bitcoind -regtest` succeeds
then stop and restart the node: The second `bitcoind -regtest` leads to an InitError:
`Error: Error: Unable to expand wallet descriptor from cache`
now, the wallet cannot be loaded by either version.

### Relevant log output

_No response_

### How did you obtain Bitcoin Core

Compiled from source

### What version of Bitcoin Core are you using?

v25.0rc2 / master

### Operating system and version

Ubuntu

### Machine specifications

_No response_
{
    nIndex = -1;
    keypool.vchPubKey = CPubKey();
    {
        LOCK(cs_KeyStore);
        bool fReturningInternal = fRequestedInternal;
        fReturningInternal &= (IsHDEnabled() && m_storage.CanSupportFeature(FEATURE_HD_SPLIT)) || m_storage.IsWalletFlagSet(WALLET_FLAG_DISABLE_PRIVATE_KEYS);
        bool use_split_keypool = set_pre_split_keypool.empty();
        std::set<int64_t>& setKeyPool = use_split_keypool ? (fReturningInternal ? setInternalKeyPool : setExternalKeyPool) : set_pre_split_keypool;
        
        if (setKeyPool.empty()) {
            return false;
        }
        WalletBatch batch(m_storage.GetDatabase());
        auto it = setKeyPool.begin();
        nIndex = *it;
        setKeyPool.erase(it);
        if (!batch.ReadPool(nIndex, keypool)) {
            throw std::runtime_error(std::string(__func__) + ": read failed");
        }
        CPubKey pk;
        if (!GetPubKey(keypool.vchPubKey.GetID(), pk)) {