Per ECMA, String(obj) should throw TypeError when both
obj.toString() and obj.valueOf() return objects. Was returning
"[object Object]" instead, silently swallowing the spec violation.
Replaced the inner fallback with (raise (js-new-call TypeError ...)).
Preserves the outer "[object Object]" for the case where there's
no toString lambda. Fixes S8.12.8_A1.
built-ins/String: 75/99 → 77/99 (canonical, best run).
conformance.sh: 148/148.