What data does the Bitcoin Core wallet retrieve during a blockchain rescan?

Does the wallet database store a table of all actual output scripts (e.g. watchdog programs) derived from the keypool?

Yes, that’s right. The descriptor (and legacy data for legacy wallets) is expanded with a set of scriptPubKeys to look for.

• If the scriptPubKey matches an item in that set, the transaction output is ours.
• If a transaction input consumes our output, then that input is ours.
• If we have at least one input or output, the transaction is ours.

There is no need to check witness data for input. It is enough to find the expenditure of our output (by txid:vout).