Update #1:
I have changed line in /etc/default/grub to:

GRUB_CMDLINE_LINUX="ro"

it is functional, but ugly: in command-line there are now both rw ro.

Update #2:
I have changed line in /etc/grub.d/10_linux, rw to ro:

    linux    ${rel_dirname}/${basename} root=${linux_root_device_thisversion} ro ${args}

and it seems to be fine and pretty, now.

# <file system>                            <dir>    <type>    <options>        <dump>    <pass>
UUID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx    /    ext4    rw,noatime,commit=1000    0    1

(I have replaced UUID only here, because I do not know, if it is not sensitive information, in /etc/fstab, there is real UUID equivalent to one given by blkid.)
But in my /etc/mtab, there is this line about / partition:

dev/sda1 / ext4 rw,relatime,data=ordered 0 0

I have looked on wiki.gentoo.org: fstab, I have changed all mentioned services (localmount, netmount, fsck, root, sysfs, devfs, except netmount) to boot time, but it does not help.
Why do they differ?
How to set up it for correct configuration?

P.S.
I do not know. if it is relevant, but the computer is Lenovo ThinkPad X200 with Libreboot.

Update:
Fallback initramfs image gives the same result.
findmnt check is OK:

# findmnt --verify
Success, no errors or warnings detected