docs(changelog): note federation re-apply needed for IAM action drift fix

PR #1219 reconciles the AWS IAM action lists between the CloudFormation
stack, the Terraform lambda/fargate modules, and the federation CFN/TF/CLI
templates -- but existing customer deployments do not auto-update. Bundles
deployed before this PR continue to silently degrade until re-applied:
federation roles lack the CE Get*Coverage actions (coverage-targeted sizing
assumes zero coverage), the cross-account CFN flavor lacks the optional
EnableOrgDiscovery parameter and the legacy CE statement, and runtime
deployments lack the new EC2 RI exchange actions and the new-style es:*
OpenSearch actions.

Add a Notices entry mirroring the existing 2026-04-22 federation-bundle
precedent so the operational impact is visible to upgrading customers.

Author: cristim

CHANGELOG.md

@@ -15,6 +15,20 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/).
   CloudFormation deploy scripts had no registration call at all).
   Re-download the bundle from the CUDly UI and the new copy will register
   your account automatically with no manual edits required.
+- **Federation IaC bundles deployed before #1219 need to be re-applied** to
+  pick up reconciled IAM action grants. Older bundles silently degrade on
+  federated accounts: the Cost Explorer `Get*Coverage` actions are missing
+  (coverage-targeted sizing assumes zero existing coverage), and the
+  cross-account CloudFormation flavor lacks the optional `EnableOrgDiscovery`
+  parameter and the legacy CE statement that the original `CUDly-CrossAccount`
+  template carried. Re-download the federation bundle from the CUDly UI and
+  re-apply (`terraform apply` / `aws cloudformation update-stack`) -- no
+  manual edits required, no changes to existing CUDly resources. Customers
+  on the runtime CloudFormation stack or Terraform lambda/fargate modules
+  also need an update to pick up the new `ec2:*ReservedInstancesExchangeQuote`
+  actions, `ec2:DescribeRegions`, `rds:DescribeDBInstances`, and the
+  new-style `es:*ReservedInstance*` OpenSearch actions (replacing the legacy
+  `es:*ReservedElasticsearch*` names).
 
 ### Fixed