js-on-sx: .constructor backlink on Number/String/Array/Object protos (+1)

Number.prototype.constructor === Number etc. Four dict-set! lines add
the backlink after each constructor dict is defined.

new String().constructor === String now returns true. Array literals
don't yet link to Array.prototype so [].constructor === Array is still
false — that would need a boxing refactor.

Unit 521/522, slice 148/148 unchanged.
Number 76/100 → 77/100 (+1). String variance-heavy under CPU load.

lib/js/runtime.sx

@@ -2522,6 +2522,8 @@
 
 (dict-set! Number "name" "Number")
 
+(dict-set! (get Number "prototype") "constructor" Number)
+
 (define isFinite js-global-is-finite)
 
 (define isNaN js-global-is-nan)
@@ -2884,6 +2886,8 @@
 
 (dict-set! Object "name" "Object")
 
+(dict-set! (get Object "prototype") "constructor" Object)
+
 (define
   js-delete-prop
   (fn
@@ -2974,6 +2978,8 @@
 
 (dict-set! Array "length" 1)
 
+(dict-set! (get Array "prototype") "constructor" Array)
+
 (dict-set! Array "name" "Array")
 
 (define
@@ -3006,6 +3012,8 @@
 
 (dict-set! String "length" 1)
 
+(dict-set! (get String "prototype") "constructor" String)
+
 (dict-set! String "name" "String")
 
 (define Boolean {:__callable__ (fn (&rest args) (if (= (len args) 0) false (js-to-boolean (nth args 0))))})