A full node downloads every block and checks every transaction against the consensus rules: valid signatures, no double spends, correct subsidy, hash below target, size limits, script rules. Anyone can run one on a modest computer. Tens of thousands do.
Miners propose, nodes dispose
A block with an invalid transaction is rejected by nodes however much work it contains. The miner wasted its electricity. This is why miners cannot change the rules: a block paying a 50 BTC subsidy today would be ignored by every node, and so by every other miner. Hash power decides the order of valid blocks; it does not decide what valid means.
Forks in the chain
Two miners sometimes find blocks seconds apart. Nodes keep both until one is extended, then follow the valid chain with the most accumulated work and discard the other (a reorganisation). This is why six confirmations is a common standard: a six-deep reorg against honest miners is practically impossible.
Changing the rules
Because every node enforces the rules it chose to run, changing them requires node operators to agree to upgrade. Soft forks tighten rules and stay compatible with old nodes; hard forks loosen them and split anyone who does not upgrade onto a different chain. Bitcoin's history is almost entirely soft forks, which is why its rules change slowly and rarely. The 2017 SegWit activation was forced by users running nodes, over the objection of most miners: the clearest demonstration of where power lies.