The big problem is your redirection. At the moment, you DO NOT redirect people on the https website. Read more about the changes you have to make here -> https://moz.com/learn/seo/redirection. Basically, if you run on Apache, you need to modify your htaccess file and everyone who lands on the non-ssl version should be redirected to the https one. A quick Google search will give you examples of rules to include in your file. For example: https://uk.godaddy.com/help/redirect-http-to-https-automatically-8828.
In terms of the questions you asked:
-
you should modify the settings of the website and set the https as the preferred version. You shouldn't have two different sitemaps. The non-ssl one should not even work (it should be redirected as mentioned above)
-
Of course your robots.txt version should include the https links. Again, the one without them should be already redirected.
Hope this helps.
Since you are trying to shift your entire domain, make sure you will be adding a 301 (permanent) redirect.