The big problem is your redirection. At the moment, you DO NOT redirect people on the https website. Read more about the changes you have to make here -> https://moz.com/learn/seo/redirection. Basically, if you run on Apache, you need to modify your htaccess file and everyone who lands on the non-ssl version should be redirected to the https one. A quick Google search will give you examples of rules to include in your file. For example: https://uk.godaddy.com/help/redirect-http-to-https-automatically-8828.
In terms of the questions you asked:
-
you should modify the settings of the website and set the https as the preferred version. You shouldn't have two different sitemaps. The non-ssl one should not even work (it should be redirected as mentioned above)
-
Of course your robots.txt version should include the https links. Again, the one without them should be already redirected.
Hope this helps.