How are mining pools authenticated to clients? Hijacking the connection between a powerful mining cluster and its mining pool, then impersonating the pool and claiming the mining results seems to be a likely attack.

How are mining pools authenticated to clients to avoid such attacks?
The mining pools do not authenticate themselves to the miners in any special way beyond what is used in their communication protocol. If the pool takes calls on a non-encrypted socket, the communication can be intercepted and changed - a normal man-in-the-middle attack. If a pool uses a SSH certificate, that is something that can't be mimicked by an attacker and would make such an attack impossible. The mining protocol itself does not add any extra security.

The person running the mining operation can always tell that something is fishy if they pay close attention to their miners' productivity and downtime, but that is not part of the protocol.