Relation between short and «regular» Schnorr signature
@Maher's comments guided me to understanding.
To prove security of short Schnorr signature from security of «regular» Schnorr signature with the same hash $H$, we hypothesizes a PPT algorithm $\mathcal A$ that breaks short Schnorr signature, and use it to build algorithm $\mathcal A'$ that breaks regular Schnorr signature, as follows.
$\mathcal A'$ does as $\mathcal A$, except:

Whenever $\mathcal A$ requests a signature: $\mathcal A'$ requests a signature for the same message $m$ from the regular Schnorr signature oracle, gets a regular signature $(u_t,\alpha_z)$, turns it into a short signature $(H(m,u_t),\alpha_z)$ by applying $u_t\mapsto H(u_t,m)$ to the first component of the signature, and uses that for whatever $\mathcal A$ does.
When and if $\mathcal A$ outputs a forgery: $\mathcal A'$ turns that short signature forgery into a regular signature forgery by applying $c\mapsto g^{\alpha_z}\,u^{-c}$ to the first component of the forgery, using only knowledge of public key $u$ and the group parameters.

Algorithm $\mathcal A'$ remains PPT, and breaks regular Schnorr signature with the same probability as $\mathcal A$; only extra cost are more queries to the random oracle performing the hash, and the final computation for the forgery.

What Boneh and Shoup's 19.2.3 leaves unclear to me is how it's justified

It will be sufficient to work with 128-bit challenges.

that is why $H$ with output much narrower that the group order will do in regular Schnorr signature.