Your regex captures the colon into $1 and the left curly brace into $2 the first time through. The g modifier makes it attempt to capture 2 more characters AFTER the left curly brace, but there is only one character remaining (double quote), so the match fails. Just capture one matching character:

$foo =~ s/([:,{])/$1 /g;
[download]