How does a client know it is connected to the right P2P network? Global botnets of "pwned" machines exist. Hypothetically, such a botnet could be configured to look a lot like the Bitcoin peer-to-peer network.

It could even have a long (fake) block chain, full of fake timestamps showing years' worth of history where the difficulty just never got very high.

My question is simple: How does the Bitcoin client know it is connected to the "real" Bitcoin P2P network and not to an impostor? That is, what mechanisms does it use to make this identification with confidence?

The more such mechanisms you identify, the better your answer is, in my view. Thanks.
There's a list of hardcoded blocks in the bitcoin client: https://github.com/bitcoin/bitcoin/blob/master/src/checkpoints.cpp 

However, you present an entirely valid attack. If I can control one DNS seed and DDOS the others, I could cause new clients to only connect to my network.