Selecting an appropriate key for HMAC
Sending the MAC key with the message pretty much negates the point of a MAC, since anyone can modify the message and regenerate a new MAC using the key. Nothing theoretical with that. You might as well omit the MAC entirely.(1)

So yes, the MAC key should be considered a secret, just like the encryption key. 

I think the answer in the question you linked pretty much answers the rest of your questions: Yes, you should use independent keys for the encryption and the MAC, because otherwise you run the risk of subtle interactions between the algorithms foiling your scheme. Though in the case of AES and HMAC-SHA256 you'll likely get away with it, but it would still be good hygiene to use distinct keys. Run your master key through a KDF (or just a strong hash like SHA-512) to get separate keys for the encryption and the MAC.

Of course you could generate the MAC key from random bytes given by your system's RNG, but you'd still need to transfer the key to the other end. That would need to be done similarly to how the encryption key is transmitted, not at the per-message logic which you've shown. 

(1) Though an unkeyed hash would still serve to detect accidental corruption.