js-on-sx: fn.toString honours Function.prototype.toString overrides

Two hardcoded paths returned the native marker regardless of user
override: js-invoke-function-method and the lambda branch of
js-to-string. Both now look up Function.prototype.toString via
js-dict-get-walk and invoke it on the function, falling back to
the native marker only if no override exists.
built-ins/String: 84/99 → 85/99. conformance.sh: 148/148.

lib/js/test262-scoreboard.md

@@ -1,13 +1,13 @@
 # test262 scoreboard
 
 Pinned commit: `d5e73fc8d2c663554fb72e2380a8c2bc1a318a33`
-Wall time: 192.4s
+Wall time: 182.4s
 
-**Total:** 84/99 runnable passed (84.8%). Raw: pass=84 fail=12 skip=1 timeout=3 total=100.
+**Total:** 85/99 runnable passed (85.9%). Raw: pass=85 fail=11 skip=1 timeout=3 total=100.
 
 ## Top failure modes
 
-- **10x** Test262Error (assertion failed)
+- **9x** Test262Error (assertion failed)
 - **3x** Timeout
 - **1x** ReferenceError (undefined symbol)
 - **1x** SyntaxError (parse/unsupported syntax)
@@ -16,13 +16,13 @@ Wall time: 192.4s
 
 | Category | Pass | Fail | Skip | Timeout | Total | Pass % |
 |---|---:|---:|---:|---:|---:|---:|
-| built-ins/String | 84 | 12 | 1 | 3 | 100 | 84.8% |
+| built-ins/String | 85 | 11 | 1 | 3 | 100 | 85.9% |
 
 ## Per-category top failures (min 10 runnable, worst first)
 
-### built-ins/String  (84/99 — 84.8%)
+### built-ins/String  (85/99 — 85.9%)
 
-- **10x** Test262Error (assertion failed)
+- **9x** Test262Error (assertion failed)
 - **3x** Timeout
 - **1x** ReferenceError (undefined symbol)
 - **1x** SyntaxError (parse/unsupported syntax)