Thanks for describing the issue in details here. It helps everyone who may have the same issue.
Good to see that normal configuration works for you. Does your factory configuration need 4-byte addressing? I guess not. Even if the configuration requires > 128Mb, you may still be using 3-byte addressing to start the read, then the burst read can continue to the upper half of the device.
For Remote Update, perhaps the IP uses 4-byte addressing so it did not work. To find out exactly what is not working, dummy cycle, 4-byte mode, or specific command, it would be nice if you can hook up a logic analyzer to the SPI bus and capture the first read of the Remote Update. In that case, you know exactly what data the flash is outputting at which cycle. If the dummy cycle is not set up correctly, you may be able to set it before the Remote Update read starts.
Contacting Altera is definitely helpful is they give you support. You should contact them to see if they can give you suggestions too.