js-on-sx: Object.prototype.toString dispatches by [[Class]]

Was hardcoded to "[object Object]" for everything; per ES it should
return "[object Array]", "[object Function]", "[object Number]",
etc. by class. Added js-object-tostring-class helper that switches
on type-of and dict-internal markers (__js_*_value__,
__callable__). Prototype-identity checks ensure
Object.prototype.toString.call(Number.prototype) returns
"[object Number]" (similar for String/Boolean/Array).
built-ins/Array: 18/45 → 20/45, built-ins/Number: 43/50 → 44/50.
conformance.sh: 148/148.

lib/js/test262-scoreboard.md

@@ -1,17 +1,24 @@
 # test262 scoreboard
 
 Pinned commit: `d5e73fc8d2c663554fb72e2380a8c2bc1a318a33`
-Wall time: 9.0s
+Wall time: 57.4s
 
-**Total:** 45/45 runnable passed (100.0%). Raw: pass=45 fail=0 skip=5 timeout=0 total=50.
+**Total:** 44/50 runnable passed (88.0%). Raw: pass=44 fail=3 skip=0 timeout=3 total=50.
 
 ## Top failure modes
 
+- **3x** Timeout
+- **3x** Test262Error (assertion failed)
 
 ## Categories (worst pass-rate first, min 10 runnable)
 
 | Category | Pass | Fail | Skip | Timeout | Total | Pass % |
 |---|---:|---:|---:|---:|---:|---:|
-| built-ins/Math | 45 | 0 | 5 | 0 | 50 | 100.0% |
+| built-ins/Number | 44 | 3 | 0 | 3 | 50 | 88.0% |
 
 ## Per-category top failures (min 10 runnable, worst first)
+
+### built-ins/Number  (44/50 — 88.0%)
+
+- **3x** Timeout
+- **3x** Test262Error (assertion failed)