Two hardcoded paths returned the native marker regardless of user
override: js-invoke-function-method and the lambda branch of
js-to-string. Both now look up Function.prototype.toString via
js-dict-get-walk and invoke it on the function, falling back to
the native marker only if no override exists.
built-ins/String: 84/99 → 85/99. conformance.sh: 148/148.