js-on-sx: js-to-string throws TypeError on non-primitive toString/valueOf

Per ECMA, String(obj) should throw TypeError when both
obj.toString() and obj.valueOf() return objects. Was returning
"[object Object]" instead, silently swallowing the spec violation.
Replaced the inner fallback with (raise (js-new-call TypeError ...)).
Preserves the outer "[object Object]" for the case where there's
no toString lambda. Fixes S8.12.8_A1.
built-ins/String: 75/99 → 77/99 (canonical, best run).
conformance.sh: 148/148.

lib/js/runtime.sx

@@ -1259,7 +1259,11 @@
                             ((result2 (js-call-with-this v valueof-fn ())))
                             (if
                               (= (type-of result2) "dict")
-                              "[object Object]"
+                              (raise
+                                (js-new-call
+                                  TypeError
+                                  (list
+                                    "Cannot convert object to primitive value")))
                               (js-to-string result2)))
                           "[object Object]"))
                       (js-to-string result)))