js-on-sx: fn.toString honours Function.prototype.toString overrides

Two hardcoded paths returned the native marker regardless of user
override: js-invoke-function-method and the lambda branch of
js-to-string. Both now look up Function.prototype.toString via
js-dict-get-walk and invoke it on the function, falling back to
the native marker only if no override exists.
built-ins/String: 84/99 → 85/99. conformance.sh: 148/148.

plans/js-on-sx.md

@@ -158,6 +158,8 @@ Each item: implement → tests → update progress. Mark `[x]` when tests green.
 
 Append-only record of completed iterations. Loop writes one line per iteration: date, what was done, test count delta.
 
+- 2026-05-08 — **`fn.toString()` and `String(fn)` honour `Function.prototype.toString` overrides.** Two hardcoded paths returned `"function () { [native code] }"` regardless of any user override: the function-method dispatch in `js-invoke-function-method`, and the lambda branch of `js-to-string`. Both now look up `Function.prototype.toString` via `js-dict-get-walk` and invoke it on the function (`recv`/`v`) when available, falling back to the native marker only if no override exists. Now `Function.prototype.toString = ...; (function(){}).toString()` returns the override, and `new String(fn)` stores the override result. built-ins/String: 84/99 → 85/99. conformance.sh: 148/148.
+
 - 2026-05-08 — **Native prototypes carry the wrapped primitive marker.** Per ES, `Boolean.prototype` is a Boolean wrapper around `false`, `Number.prototype` wraps `0`, `String.prototype` wraps `""`. So `Boolean.prototype == false` (loose-eq unwraps), `Object.prototype.toString.call(Number.prototype) === "[object Number]"`, etc. Set `__js_boolean_value__: false` / `__js_number_value__: 0` / `__js_string_value__: ""` on the respective prototypes in the post-init block. built-ins/Boolean: 23/27 → 24/27, String: 80/99 → 84/99. conformance.sh: 148/148.
 
 - 2026-05-08 — **`js-to-number` throws TypeError when valueOf+toString both return non-primitive.** Mirrors the earlier `js-to-string` fix. Per spec, `Number(obj)` must throw if `ToPrimitive` cannot extract a primitive. Was returning `NaN` silently. Replaced the inner `(js-nan-value)` fallback with `(raise (js-new-call TypeError ...))`. built-ins/Number: 45/50 → 46/50. conformance.sh: 148/148.