js-on-sx: lexer handles \uXXXX and \xXX string escapes

read-string fell through to the literal-char branch for \u and \x,
silently stripping the backslash ("A".length returned 5 instead
of 1). Added js-hex-value helper and two cond clauses that read the
hex digits via js-peek + js-hex-digit?, compute the code point, and
emit it via char-from-code. Invalid escapes fall through to the
literal-char behaviour. built-ins/String (with --restart-every 1):
65/99 → 68/99. conformance.sh: 148/148.

lib/js/test262-scoreboard.json

@@ -1,9 +1,9 @@
 {
   "totals": {
     "pass": 65,
-    "fail": 26,
+    "fail": 28,
     "skip": 1,
-    "timeout": 8,
+    "timeout": 6,
     "total": 100,
     "runnable": 99,
     "pass_rate": 65.7
@@ -13,9 +13,9 @@
       "category": "built-ins/String",
       "total": 100,
       "pass": 65,
-      "fail": 26,
+      "fail": 28,
       "skip": 1,
-      "timeout": 8,
+      "timeout": 6,
       "pass_rate": 65.7,
       "top_failures": [
         [
@@ -23,11 +23,11 @@
           16
         ],
         [
-          "Timeout",
+          "TypeError: not a function",
           8
         ],
         [
-          "TypeError: not a function",
+          "Timeout",
           6
         ],
         [
@@ -47,11 +47,11 @@
       16
     ],
     [
-      "Timeout",
+      "TypeError: not a function",
       8
     ],
     [
-      "TypeError: not a function",
+      "Timeout",
       6
     ],
     [
@@ -68,6 +68,6 @@
     ]
   ],
   "pinned_commit": "d5e73fc8d2c663554fb72e2380a8c2bc1a318a33",
-  "elapsed_seconds": 420.4,
+  "elapsed_seconds": 353.1,
   "workers": 1
 }