Setting up a watch-only wallet for an old Core wallet

So here's the situation: I've got an old non-descriptor wallet from 2013 on a fresh offline setup. It only had two addresses used back in 2013-2014. I managed to open this wallet using Bitcoin Core 28 and migrated it to a descriptor wallet, but now I see a ton of descriptors in the list that I don’t really need. All of this is happening on an offline machine. I want to create a watch-only wallet for those two addresses (I think I should use the corresponding pkh descriptors) on an online machine. After that, I need to make an unsigned transaction to move the coins from those old addresses to a new HD wallet, which I plan to sign offline later. My concern is that the core client can't generate new keys in a legacy non-HD watch-only wallet. Not sure if that type exists. I don’t really need change addresses for this, but I feel like I might be missing something. What do you think is the safest way to handle this? Can I have both legacy and HD descriptors in the same wallet? If I do that, will the core client derive change addresses from the xpub keys?

There's no such thing as legacy descriptors. You cannot mix both watchonly descriptors and descriptors with private keys in the same wallet. However, you can create a blank descriptor wallet and import the watchonly descriptors for the 2 addresses you used. You can then use this wallet to create a PSBT sending the coins somewhere else. The PSBT can be transferred to the offline machine to be signed, and back to the online one for broadcast. With such a wallet, there is no risk for loss because of change as the wallet will be unable to generate any change addresses, so if any change is needed, it will simply fail to create the transaction. You can further reduce risk here by using the sendall RPC.

Or the corresponding button in the GUI? Thanks for the explanation, that helps me a lot! I have two more questions if you have time to answer.   1. I have imported one of the descriptors (pkh) on the online machine. The daemon has started a rescan. This probably takes a very long time in my case. The RPC call ended with a timeout at some point. But the daemon continued rescanning. Then I terminated the daemon during the rescan as a test and started it again. But it does not continue with the rescan after restart.  I know that the displayed balance is correct, but why doesn't it continue the rescan or start it again? I have also reloaded the wallet. 2. I have received 4 descriptors with the same pubkey for each legacy address. The types are pk, pkh, sh(wpkh), wpkh. I have now used the pkh descriptor. But could I also use the others? What should I use? I would like to transfer the balance of the legacy address to a segwit address (bc1).

That's actually a different mechanism from sendall, although it should have the same effect. Rescan state is not persisted in all instances. You can trigger another rescan using rescanblockchain. Legacy wallets could receive to each of these address types for any key in the wallet, so the migration creates these (or a combo() descriptor). To be safe, you can import them all, but if you know which address type you had used, then you can just import that specific one.