Share encrypted files without giving master key
Yes, it's safe, as you can't calculate the secret key from the HMAC result. HMAC would be useless without this feature
No, Bob will not be able to use his key to calculate the other keys, as long as you use a  reasonable hash function (SHA-2 should fit)
It's the same as 1., Bob doesn't get more information by more derived keys


But when Bob get the key for filename2 and Carlos for filename3, then it's important that Bob nor Carlos are able to affect the filenames.
Otherwise they could create a key for a encrypted file related to another person