The first example is correct and what most people would say. The second is incorrect.

The first one is correct, the second one is not.

In a more general way:

• “C’est moi qui” is grammatically equivalent to “je“.

• “C’est toi qui” is grammatically equivalent to “tu“.

So you will conjugate the following verb accordingly.

“Ce n’est pas moi qui l’ai” can be seen as “Je ne l’ai pas” where the first person is obvious.

The first one is correct. Finding references on this is not easy but I’ll give it a shot.

The eigth version of the Dictionnaire de l’Académie states in its entry for “moi”:

Il figure aussi dans certains tours particuliers, soit comme sujet,
soit comme complément.

C’est moi qui vous en réponds.

Si c’était moi qui avais fait cela…

C’est de moi qu’il s’agit !

C’est à moi qu’il faudra vous adresser.

C’est moi qu’il a pris à partie.

Meaning that moi can become the subject in this particular case (on the contrary to English for instance, where you’d say It’s me who knows).

You will also find here:

C’est, suivi d’un nom au pluriel ou d’un pronom autre que personnel,
s’accorde avec celui-ci.

Meaning if c’est is followed by a personal pronoun (such as moi, if you’re still following), then this pronoun dictates the person that will be used.