Why this brute force attack doesn't reduce all cryptographic hash functions' security bits against collision attacks to N/3?
Let $M$ be the number of queries to a uniform random function $F$ at distinct points $X_1, X_2, \dots, X_M$.  The probability of a repeated value $F(X_i) = F(X_j)$ for $i \ne j$ is at most $M^2\!\big/2^N$ by the birthday paradox.  For $M = 2^{N/3}$, this is $2^{2N/3}\!\big/2^N = 1\big/2^{N - 2N/3} = 1\big/2^{N/3}$.  If your calculation doesn't fit this bound, there's an error in your calculation.

‘But what if we come upon a short cycle in $H \mapsto F(S \mathbin\| H)$?’, you ask.  The expected number of points before a repeat in a uniform random function on a domain of $2^N$ elements is $\frac12\sqrt{2\pi\,2^N} - 1 \approx 2^{N/2}$ (Harris 1960 Eqs. 3.4 &amp; 3.11, see paper for more details of distribution; paywall-free).  So no, this method doesn't improve the expected cost.

Using a clever tortoise-chasing-hare algorithm to find a cycle, rather than making a big table and checking for duplicates, may reduce the memory or area*time cost of an attack, as in the van Oorschot–Wiener parallel collision search machine, but it doesn't escape the birthday bound!