Why is EdDSA collision-resilient with SHA-512?
The relevant part of Neven et al is this:


  What this means for practice is that one should not instantiate the hash function with a Merkle-Damgård iteration of an $n$-bit compression function. Instead, one should probably simply truncate the output of a $2n$-bit hash function to $n$ bits. (Such a method would in our situation be reminiscent of Lucks’ wide-pipe hash [Luc05].) Therefore, using for example the first 128 bits of the SHA-256 hash should in practice provide a security level of 128 bits.


Ed25519 uses SHA-512, a 512-bit hash function. If the herding attack applies but the hash function itself is secure, its security level should be at least about 256 bits (the collision resistance of the hash function). That is way more than the security of the overall algorithm and so not relevant here.

Even if some collision attack on the ~256-bit number that results from the multiplication (after reduction modulo $l$) would allow breaking the signature scheme, that would still not break the claimed ~128-bit security level.

I.e. rather than running into problems due to using a half length Merkle–Damgård hash, Ed25519 uses a conservative double length hash and should not be affected.