Relation between short and «regular» Schnorr signature I'm failing to fully understand the reasoning in 19.2.3 of Boneh and Shoup's A Graduate Course in Applied Cryptography. That constructs short («optimized»/original) Schnorr signature from «regular» (modern) Schnorr signature.
I get the construction, and that it's described by

The transformation $(u_t,\alpha_z)\mapsto(H(m,u_t),\alpha_z)$ maps a regular Schnorr signature on $m$ to an optimized Schnorr signature, while the transformation $(H(m,u_t),\alpha_z)\mapsto(u_t,\alpha_z)$ maps an
optimized Schnorr signature to a regular Schnorr signature.

Thanks to helpful comments, I now fully understand the mappings, and can now answer my original question: why

It follows that forging an optimized Schnorr signature is equivalent to forging a regular Schnorr signature.

Update: But I lack understanding of why

It will be sufficient to work with 128-bit challenges.

My thinking is that the proof of the regular Schnorr signature models the hash as a random oracle, but we can't model something with a 128-bit output as a random oracle and claim 128-bit security. Also, I'm worried the reduction to the Discrete Logarithm Problem could become one to a different DLP with some 128-bit limitation. And that could be an issue: for example, the problem of finding $x$ given $(g,y)$ with $y=g^x$ becomes tractable¹ when we limit $x$ to 128-bit, or to $x=a\,x'+b$ with 128-bit $x'$ and given $(a,b)$.
Update 2: Pondering that comment, the crux seems to be that a verifier in Schnorr's identification/Σ-protocol needs only a $t$-bit challenge for error probability $2^{-t}$. But that's still foggy for me.

¹ by Baby-Step/Giant-Step in principle, or Pollard's Rho in practice
@Maher's comments guided me to understanding.
To prove security of short Schnorr signature from security of «regular» Schnorr signature with the same hash $H$, we hypothesizes a PPT algorithm $\mathcal A$ that breaks short Schnorr signature, and use it to build algorithm $\mathcal A'$ that breaks regular Schnorr signature, as follows.
$\mathcal A'$ does as $\mathcal A$, except:

Whenever $\mathcal A$ requests a signature: $\mathcal A'$ requests a signature for the same message $m$ from the regular Schnorr signature oracle, gets a regular signature $(u_t,\alpha_z)$, turns it into a short signature $(H(m,u_t),\alpha_z)$ by applying $u_t\mapsto H(u_t,m)$ to the first component of the signature, and uses that for whatever $\mathcal A$ does.
When and if $\mathcal A$ outputs a forgery: $\mathcal A'$ turns that short signature forgery into a regular signature forgery by applying $c\mapsto g^{\alpha_z}\,u^{-c}$ to the first component of the forgery, using only knowledge of public key $u$ and the group parameters.

Algorithm $\mathcal A'$ remains PPT, and breaks regular Schnorr signature with the same probability as $\mathcal A$; only extra cost are more queries to the random oracle performing the hash, and the final computation for the forgery.

What Boneh and Shoup's 19.2.3 leaves unclear to me is how it's justified

It will be sufficient to work with 128-bit challenges.

that is why $H$ with output much narrower that the group order will do in regular Schnorr signature.