Given the current hashing powers, what do pools actually do in practice?
For a given combination of

version(4b) + prevBlockHash(32b) + merkleHash(32b) + ctimestamp(4b) + ctarget(4b),

There is no guarantee that there will be a valid nonce. There usually isn't - the probability that there will be is 1 divided by the difficulty, which is currently 9 billion. So miners try different combinations, try the nonce range for each, until they find a valid solution.

a) The most general method is to change extraneous data in the generation transaction to change the Merkle root. Currently, to reduce communication overhead between the pool and miners, a method such as GBT is used, where the miner gets a block template and can fill in the generation transaction himself.

b) No; hashing, like much of the core cryptographic primitives, is kind of a "dark art" - there's little in the way of proof that it all works. Let's say you fix just the prevBlockHash, there is no proof that you can fill in the other details to obtain a valid hash. However, if hash functions behave more or less the way we think they do, it is extremely unlikely there will be no solution.