- Yes 2. No 3. No
or yes, slightly too late, sorry! But not a big problemunless you wanna break the students trust.
In the latter case: do whatever is legal in your department/country.
If the exam was midterm, you easily could have pointed that out then. That would not have been a problem for anyone. But now it is too late:
To address the debate whether 10 days are enough or not: It depends a lot on the course! But given the time-frame of half a semester, so months, 10 days is relatively short. Or "too short not to be clearly long enough"
Students are humans too, they have a lot of plans and preparation. They have to stick to strict rules (passing exams or byebye). Those rules are set like laws and, in general, cannot be changed in between (imagine a football play where the rules randomly change in between?!). If you slightly modify them early enough so that no one can really bring up a reason why this is to it's disadvantage, than you can change the rules. The student on the other hand brought up a very good reason why this close call is to is disadvantage. (reason for 1 & 2)
And to 3: No, he is doing absolutely the right thing. Students are in a hierarchical way below you. But you cannot do whatever you want! You tried to, the student noticed, reached you, you didn't agree, so he escalated to a higher institution. Perfectly, as taken from a textbook of "how to properly deal with hierarchies".
My advide: ASAP (!) tell them that everything can be used and learn from it (1. say it earlier and 2. restrict the cheat sheets to handwritten ones). Even better, change the exam. If the students who have printed the whole course really have an advantage, than the exam isn't very good. Ask more questions where you have to know the general ideas, know how things are related. Ask enough questions in the time allowing the prepared students to answer a lot and not allowing to read through the whole course again.
Sidenote: yes, probably you can legally do that. It depends a lot on your country. But it is something I would avoid as much as possible, as it makes a very bad impression on the students. Fact is: they have the disadvantage because you did not care too much about the teaching (but did research). Whereas the latter is no problem at all and I fully understand, it is like if it is your problem if your boss comes late (because he did not care about your project). Sure, happens, sure, you may have to deal with the consequences but I think you understand: legally - maybe. Advisable to do - no. Most of all, because there is no urgent reason to do it.