agent: reaper: get active set after candidates

Get the active set after enumerating containers in namespace to avoid
false positives.