Badge Time Security Alert

A security event streaming pipeline ingests badge access logs and must flag anomalous access patterns in near-real-time — a common use case for rule-based alerting on top of time-series event data. Given a list of badge records, identify employees who triggered 3 or more accesses within any 60-minute window. **Input:** A list `badge_records` where each record is `[name, timestamp]` with `timestamp` as a Unix epoch integer (seconds). **Output:** A list of employee names who have 3 or more badge events within any rolling 60-minute window. Order does not matter. **Key Rules:** - A 60-minute window is 3600 seconds (`timestamp[last] - timestamp[first] <= 3600`). - Records may arrive out of order; sort each employee's timestamps before applying the window. - Each employee's timestamps are checked independently.