planner: address ref head issue, don't optimize where it's incorrect #11827

Job	Run time
Rego PR checks	1m 37s
Go Lint	2m 49s
YAML Lint	18s
Generate Code	1m 7s
Check Generated	32s
Go compat build/test (ubuntu-24.04, 1.21)	1m 34s
Go Test (linux)	1m 34s
Go compat build/test (macos-14, 1.21)	1m 36s
Go Build (linux amd64)	1m 33s
Go Test (darwin)	1m 33s
Go Build (linux arm64)	1m 33s
Go Build (linux arm64GO_TAGS="-tags=opa_no_oci")	1m 33s
Go Race Detector	1m 33s
Go Build (windows amd64)	1m 34s
WASM	1m 33s
Go Build (darwin amd64)	1m 10s
Go Build (darwin arm64)	44s
docker image smoke test	1s
smoke-test-binaries	1s
	23m 55s

Provide feedback