js-on-sx: callable-dict receivers get dict hasOwnProperty (+6 Number)

Root cause of many Number/String/Object.hasOwnProperty false-negatives:
global dicts like Number/String/Object carry a :__callable__ slot so
they can be invoked (Number(5) coerces, Array(3) makes length-3 list).
That makes js-function? return true for them, so js-invoke-method
dispatched hasOwnProperty/isPrototypeOf/propertyIsEnumerable through
js-invoke-function-objproto (whose name/length/prototype-only check
returns false for real dict keys like MAX_VALUE).

Fix: in the invoke-method cond, exclude dicts from the function-proto
branch. Callable dicts fall through to js-invoke-object-method, which
walks (keys recv) properly.

One line in a compound `and` — minimal surface, easy to revert.

Unit: 521/522 unchanged.
Conformance: 148/148 unchanged.
Number scoreboard: 46/100 → 52/100 (+6).

Impacted sample: Number.hasOwnProperty("MAX_VALUE") → true (was false),
plus S15.7.3_A2..A8 family (MAX_VALUE/MIN_VALUE/POSITIVE_INFINITY/
NEGATIVE_INFINITY existence checks) and S15.7.2.1_A2..A4.

lib/js/runtime.sx

@@ -19,7 +19,7 @@
 
 ;; ── Type predicates ───────────────────────────────────────────────
 
-(define js-max-value-approx (fn () (js-max-value-loop 1 1000)))
+(define js-max-value-approx (fn () (js-max-value-loop 1 2000)))
 
 ;; ── Boolean coercion (ToBoolean) ──────────────────────────────────
 
@@ -372,7 +372,7 @@
             ((not (js-undefined? m)) (js-call-with-this recv m args))
             ((and (js-function? recv) (js-function-method? key))
               (js-invoke-function-method recv key args))
-            ((and (js-function? recv) (js-object-builtin-method? key))
+            ((and (js-function? recv) (not (= (type-of recv) "dict")) (js-object-builtin-method? key))
               (js-invoke-function-objproto recv key args))
             ((and (= (type-of recv) "dict") (js-object-builtin-method? key))
               (js-invoke-object-method recv key args))