4: As far as the protocol is concerned, it is completely at the miner's discretion which transactions to include. It is legal if the miner chooses to include no transactions at all (other than the coinbase transaction which is required), and some miners actually do this (it means that the block is small and can be relayed quickly, which slightly decreases the chance that it will be orphaned).
Most miners will include as many unconfirmed transactions as possible, up to the block size limit, preferring those which have the highest fees. They may automatically exclude those which transfer a very small value (so-called "dust") or whose fee is below some threshold.
5: The miner is expected to verify that every transaction in his block is valid (outputs not already spent, valid ECDSA signatures, etc). When he finds a nonce which attains the target hash and submits his block to the network, other nodes will attempt to similarly verify the transactions in it, and if they are not all valid the entire block will be rejected (i.e. other miners will not use this block's hash as the "previous block" in their own mining). However, mining is not necessary for this sort of verification, since non-mining nodes will also do this verification, and refuse to recognize any transactions that don't pass.