An enterprise uses Cisco ISE for 802.1X on wired switches. When an endpoint's profile changes and it must move to a different dynamic VLAN, the administrator notices that some thin clients do not request a new DHCP address after ISE pushes the policy change, leaving them stranded on the old subnet. Which Change of Authorization (CoA) type should ISE issue to force these endpoints onto the new VLAN while triggering a fresh DHCP request without requiring a full re-authentication handshake?