Solved. When sifting the trunk files I found the 16MiB patch is in package/boot/uboot-lantiq/patches/0107-MIPS-add-board-support-for-ZyXEL-P-2812HNU-Fx.patch :
+
+#define CONFIG_SYS_BOOTM_LEN 0x1000000 /* 16 MB */
+
With the patch reverted, I build the nand-spl u-boot a second time, extracted the lzo compressed part using binwalk, and looked at the differences in the binaries. It appeared there were only four bytes different (apart from a timestamp in ascii), two pairs '00 80' which had become '01 00'. (I think I know how the 32MiB patch would work out 
). So I took @ScApi's r47026 bootloader, extracted the payload, hexedited the file and repackaged it. (And when I was there, I also edited the timestamp). It worked! This bootloaded can uncompress to >8MiB:
ROM VER: 1.0.5
CFG 06
NAND
NAND Read OK
U-Boot SPL 2013.10-openwrt5 (Nov 18 2014 - 19:54:01)
SPL: initializing NAND flash
SPL: checking U-Boot image
SPL: loading U-Boot to RAM
SPL: decompressing U-Boot with LZO
SPL: jumping to U-Boot
U-Boot 2013.10-openwrt5 (Jul 06 2021 - 10:04:01) P-2812HNU-Fx
Board: ZyXEL P-2812HNU-Fx
SoC: Lantiq VRX288 v1.1
CPU: 500 MHz
IO: 250 MHz
BUS: 250 MHz
BOOT: NAND
DRAM: 128 MiB
NAND: 128 MiB
In: serial
Out: serial
Err: serial
Net: ltq-eth
Hit any key to stop autoboot: 2 0
P-2812HNU-Fx # tftpboot openwrt-19.07.7-lantiq-xrx200-zyxel_p-2812hnu-f1-initramfs-kernel.bin
ltq_phy: addr 0, link 1, speed 1000, duplex 1
ltq_phy: addr 1, link 0, speed 10, duplex 0
ltq_phy: addr 17, link 0, speed 10, duplex 0
ltq_phy: addr 19, link 0, speed 10, duplex 0
ltq_phy: addr 5, link 0, speed 10, duplex 0
Using ltq-eth device
TFTP from server 192.168.1.2; our IP address is 192.168.1.1
Filename 'openwrt-19.07.7-lantiq-xrx200-zyxel_p-2812hnu-f1-initramfs-kernel.bin'.
Load address: 0x82000000
Loading: *#################################################################
#################################################################
#################################################################
#################################################################
#####################################################
8 MiB/s
done
Bytes transferred = 4586129 (45fa91 hex)
P-2812HNU-Fx # bootm
## Booting kernel from Legacy Image at 82000000 ...
Image Name: MIPS OpenWrt Linux-4.14.221
Created: 2021-02-15 15:22:37 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 4586065 Bytes = 4.4 MiB
Load Address: 80002000
Entry Point: 80002000
Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
Starting kernel ...
[ 0.000000] Linux version 4.14.221 (builder@buildhost) (gcc version 7.5.0 (OpenWrt GCC 7.5.0 r11306-c4a6851c72)) #0 SMP Mon Feb 15 15:22:37 2021
I uploaded the u-boot here. Thanks again, @ScApi , for providing the original u-boot!