Minimizing size of signed message with discrete-log scheme
This only answers part of the question, but here goes:

Classical Schnorr signatures start (in my notation, which I think will be helpful here) with a field $\mathbb F$, a linear map $f: \mathcal W \to \mathcal V$ over $\mathbb F$-vector spaces and a hash $H$ with codomain in $\mathbb F$. For simplicity let's take $\mathcal W = \mathbb F$. I'll use capital letters for elements of $\mathcal V$ and small ones for field elements. Intuitively, elements of $\mathcal V$ take more bits to represent than field elements.

The finite field implementation is to take primes $p, q = (p-1)/2$ and set $\mathbb F = \mathbb Z_q$,  $\mathcal V$ is an order-$q$ subgroup of $\mathbb Z_p$ generated by some $g$, vector addition is $v \oplus w := v \cdot w \pmod{p}$ and scalar multiplication (that makes the whole thing into a vector space) is $(x, V) \mapsto V^x \pmod{p}$. The linear function is $f(x) := g^x \pmod{p}$ for vanilla Schnorr.

For elliptic curve implementations (DSA, ECDSA, EdDSA) $\mathbb F$ is a finite field and $\mathcal V$ is a group defined over an appropriate elliptic curve, with point addition serving as vector addition and scalar multiplication of $x$ with $V$ is point-adding $V$ to itself $x$ times.

In both cases,


A keypair is a pair $(x, Y = f(x)) \in \mathbb F \times \mathcal V$.
To sign $M$ (which can be any bitstring), you pick a random $r \in \mathbb F$, set $A = f(r)$, $c = H(Y, A, M)$ and $s = r + cx$.
The "$4w$" version of the signature is $(A, s) \in \mathcal V \times \mathbb F$ whereas the "hash compressed" or "$3w$" version is $(c, s) \in \mathbb F \times \mathbb F$, since field elements are smaller than $\mathcal V$ elements.
The verification equations in both cases are $c = H(Y, A, M)$ and $f(s) = A + c \cdot Y$.


Which brings me to two recommendations.


In the hash-compressed version, the signature consists only of field elements, so it should not matter for signature size if you choose a finite-field or EC implementation: the size of keys (field elements) is the same for both at the same security level on keylength.com. What EC buys you is shorter $\mathcal V$ elements, which is irrelevant here. I'd personally go with Ed25519 just because I like it.
The probability of forging a proof is commonly given as $1/|\mathbb F|$ but really it's the inverse of the size of the codomain of the hash. While $s$ has to be a full field element, you can truncate the hash value $c$ to any smaller number $k$ of bits as long as you're happy with a lower soundness factor of $2^{-k}$.


EDIT: You can also do the $z_s + z_v$ bits thing here of course, but it seems like it doesn't buy you much. I thought for a bit how I'd prove the security of the version where the verifier iterates over $z_v$ "omitted" bits and the best I could come up with is a union bound, so by omitting $z_v$ bits you lose $z_v$ bits of security and force the verifier to do $2^{z_v}$ times the work, in exchange for transmitting $z_v$ fewer bits. Shortening the hash output by $z$ bits also loses you $z$ bits of security, but doesn't cause anyone more work.
(If you can prove that you can fix or omit some bits without losing that many bits of security, then of course this option becomes attractive again.)