.
5. If a nonce is found, job_id, ntime, vmask, nonce2, nonce, and user_id are sent back to the pool. Then, the pool re-create block header data, and test it.
6. Then, the pool submit validated block header data with the pool's a bitcoin address to bitcoin core network.
I believe the pool's bitcoin address must be hashed into every share the miner submits, the pool won't add it later, the pool will simply relay the block as is. Correct me if I am wrong.
No. miners submit their every share submission don't include the pool's bitcoin address, and these submit are just communication between miners and the pool.
The pool's submit to the bitcoin core (or bitcoin network) must include the pool's bitcoin address, otherwise, you won't get bitcoin rewards. The data submit include: block header data (hex big endian byte order) + variant data + coinbase data (contains a pubkey of pool's bitcoin public address) + tranaction varified data + transaction data.
The bitcoin core (bitcoin network) will calculate hash from the nonce with block header data. The bitcoin network does not deal with pool share issue, operation, etc.