- Yes 2. No 3. No
or yes, slightly too late, sorry! unless you wanna break the students trust.
In the latter case: do whatever is legal in your department/country.
If the exam was midterm, you easily could have pointed that out then. That would not have been a problem for anyone. But now it is too late:
To address the debate whether 10 days are enough or not: It depends a lot on the course! But given the time-frame of half a semester, so months, 10 days is relatively short. Or "too short not to be clearly long enough"
Students are humans too, they have a lot of plans and preparation. They have to stick to strict rules (passing exams or byebye). Those rules are set like laws and, in general, cannot be changed in between (imagine a football play where the rules randomly change in between?!). If you slightly modify them early enough so that no one can really bring up a reason why this is to it's disadvantage, than you can change the rules. The student on the other hand brought up a very good reason why this close call is to is disadvantage. (reason for 1 & 2)
And to 3: No, he is doing absolutely the right thing. Students are in a hierarchical way below you. But you cannot do whatever you want! You tried to, the student noticed, reached you, you didn't agree, so he escalated to a higher institution. Perfectly, as taken from a textbook of "how to properly deal with hierarchies".
My advide: ASAP (!) tell them that everything can be used and learn from it (1. say it earlier and 2. restrict the cheat sheets to handwritten ones). Even better, change the exam. If the students who have printed the whole course really have an advantage, than the exam isn't very good. Ask more questions where you have to know the general ideas, know how things are related. Ask enough questions in the time allowing the prepared students to answer a lot and not allowing to read through the whole course again.
Sidenote: yes, probably you can legally do that. It depends a lot on your country. But it is something I would avoid as much as possible.