The xml file has to be in the root folder of the site - where the index.htm(l) page is.

I *think* it can be deleted once Google has verified your site. I can't find a reference to it in their help, but I am sure I have had to do this in the past...