There is a nice clean implementation in tweetnacl - while we are at it, commits could be signed with eddsa (or xeddsa/vxeddsa, though I don't know if those have compact libraries?)
Isn't it a bad idea to assume uniform distribution of variance over the hash?
No, one of the characteristics of a cryptographic hash function is that output should be completely unpredictable based on input. So the probability that the low order bits will change vs the high order bits should be exactly the same given any arbitrary inputs.
Apparently not bad enough that SHA512/256 isn't in the SHA2 family.