js-on-sx: ToPrimitive treats functions as non-primitive

Per ES, ToPrimitive only accepts strings/numbers/booleans/null
/undefined as primitives — objects AND functions trigger the next
step. Was treating function returns from toString/valueOf as
primitives (recursing to extract a string), so toString returning
a function didn't fall through to valueOf. Widened the dict-only
check to (or (= type "dict") (js-function? result)) in both
js-to-string and js-to-number ToPrimitive paths.
built-ins/String: 85/99 → 86/99. conformance.sh: 148/148.

lib/js/test262-scoreboard.md

@@ -1,28 +1,24 @@
 # test262 scoreboard
 
 Pinned commit: `d5e73fc8d2c663554fb72e2380a8c2bc1a318a33`
-Wall time: 182.4s
+Wall time: 71.0s
 
-**Total:** 85/99 runnable passed (85.9%). Raw: pass=85 fail=11 skip=1 timeout=3 total=100.
+**Total:** 46/50 runnable passed (92.0%). Raw: pass=46 fail=2 skip=0 timeout=2 total=50.
 
 ## Top failure modes
 
-- **9x** Test262Error (assertion failed)
-- **3x** Timeout
-- **1x** ReferenceError (undefined symbol)
-- **1x** SyntaxError (parse/unsupported syntax)
+- **2x** Timeout
+- **2x** Test262Error (assertion failed)
 
 ## Categories (worst pass-rate first, min 10 runnable)
 
 | Category | Pass | Fail | Skip | Timeout | Total | Pass % |
 |---|---:|---:|---:|---:|---:|---:|
-| built-ins/String | 85 | 11 | 1 | 3 | 100 | 85.9% |
+| built-ins/Number | 46 | 2 | 0 | 2 | 50 | 92.0% |
 
 ## Per-category top failures (min 10 runnable, worst first)
 
-### built-ins/String  (85/99 — 85.9%)
+### built-ins/Number  (46/50 — 92.0%)
 
-- **9x** Test262Error (assertion failed)
-- **3x** Timeout
-- **1x** ReferenceError (undefined symbol)
-- **1x** SyntaxError (parse/unsupported syntax)
+- **2x** Timeout
+- **2x** Test262Error (assertion failed)