It's up to the merchant to ensure he is PCI compliant. So this means that when you as a merchant run a webshop which holds or processes carholder data you are responsible for securing it. Either you do it yourself or you transfer the risk to Heroku. To transfer the risk (or some of it) you would require an attestation from Heroku which specifically shows which controls they implement in regard to PCI-DSS. You can then use this attestation as assurance.
If you look at what they state:
We use PCI compliant payment processor Braintree for encrypting and
processing credit card payments. Heroku’s infrastructure provider is
PCI Level 1 compliant.
It doesn't mean that their whole environment is usable to store or process card holder data, it just means they, themselves are PCI compliant when they process their clients and their cards. They do not state that Heroku can be used, as is, for applications which process or store card holder data.
So to be able to have assurance from Heroku, the whole Heroku platform should be audited to provide assurance they are PCI compliant. Often these providers offer these types of statements which can cover the PCI-DSS controls in the form of an ISAE3402 (if deemed acceptable by your QSA).
Also they state they can be used for applications which need to conform to the Sarbanes and Oxley Act (SOX). These require SOC reports, which they seem to offer. SOC reports also cover a myriad of security controls which can be used for assurance in terms of PCI DSS by your QSA.
Note that it is up to the QSA to accept or decline the SOC reports, it's in his right to refuse reliance of these reports and perform the audit himself.