Fix dash-incompatible slash substitution and bump omos size threshold

v1.14.31b made it through smoke-base and validate-base (reclaim worked),
but two narrow bugs blocked the rest:

1. 'Derive platform slug' in the per-arch matrix jobs used bash
   ${PLATFORM_PAIR//\//-} which dash (/bin/sh in the runner) can't
   parse — 'Bad substitution'. Rewrote with 'tr / -'.

2. smoke-omos image size 3107 MB tripped the 3000 MB guardrail. All
   functional checks pass; the mempalace-toolkit bake-in from v1.14.30b
   added ~100 MB and the threshold was stale. Bumped to 3200 MB.

No image-level changes.

.gitea/workflows/docker-publish.yml

@@ -159,8 +159,9 @@ jobs:
       - name: Derive platform slug
         id: platform
         run: |
-          PLATFORM_PAIR="${{ matrix.platform }}"
-          echo "pair=${PLATFORM_PAIR//\//-}" >> $GITHUB_OUTPUT
+          # POSIX-safe slash substitution — act's runner container ships
+          # /bin/sh as dash, which doesn't support bash's ${VAR//a/b}.
+          echo "pair=$(echo '${{ matrix.platform }}' | tr / -)" >> $GITHUB_OUTPUT
 
       - name: Set up QEMU
         if: matrix.platform != 'linux/amd64'
@@ -220,8 +221,9 @@ jobs:
       - name: Derive platform slug
         id: platform
         run: |
-          PLATFORM_PAIR="${{ matrix.platform }}"
-          echo "pair=${PLATFORM_PAIR//\//-}" >> $GITHUB_OUTPUT
+          # POSIX-safe slash substitution — act's runner container ships
+          # /bin/sh as dash, which doesn't support bash's ${VAR//a/b}.
+          echo "pair=$(echo '${{ matrix.platform }}' | tr / -)" >> $GITHUB_OUTPUT
 
       - name: Set up QEMU
         if: matrix.platform != 'linux/amd64'