How to create a read-only snapshot in LVM, and then rollback to it after some work?

I think you are looking for lvconvert --merge. From the man page:

--merge

Merges a snapshot into its origin volume. To check if your kernel supports this feature, look for snapshot-merge in the output of dmsetup targets. If both the origin and snapshot volume are not open the merge will start immediately. Otherwise, the merge will start the first time either the origin or snapshot are activated and both are closed. Merging a snapshot into an origin that cannot be closed, for example a root filesystem, is deferred until the next time the origin volume is activated. When merging starts, the resulting logical volume will have the origin's name, minor number and UUID.
While the merge is in progress, reads or writes to the origin appear as they were directed to the snapshot being merged. When the merge finishes, the merged snapshot is removed. Multiple snapshots may be specified on the commandline or a @tag may be used to specify multiple snapshots be merged to their respective origin.

Assume you have a logical volume vg0/system which contains your / filesystem.

# create a read-only snapshot
lvcreate -pr --snapshot --name system_snapshot vg0/system
# upgrade or something
# if it fails, reboot and do this from a livecd
lvconvert --merge vg0/system_snapshot
# reboot again and you have your old system back

The reboots are only needed because in this scenario you can't unmount the filesystem. If it's not the / fs, unmount is enough.

Keep in mind that the snapshot will deleted after the merge.