I don't know. It's such a bad idea, I would never try it.
Here an idea for you, so you can figure out yourself how to do it. Right as the kernel itself is done initializing itself, it starts a process called "init" (executable stored in /sbin/init), which then does all the initialization work that it outside the kernel. In normal operation, the init executable then starts running a whole slew of shell scripts, generally together called the "rc" system. That part is all very well documents (see man init, man rc, and so on), and most experienced Unix or *BSD users understand it reasonoably well, at least well enough to administer the machine. In single user mode ... I have no idea what it does, except knowing that after a very small number of steps, it starts a shell on the console. My suggestion: Read the documentation for init and rc, and find out what it does in single user mode. Somewhere in there MIGHT be a startup script it executes (silly guess: /etc/rc.single, but that's not it, that file does not exist). Modify that startup script, and add the remount command to make root be read-write.
If that doesn't give you anything, then it can't be done by editing scripts or config files. Matter-of-fact, my hunch is that in single user mode, no script is executed at all, because the idea behind single user mode is to be as reliable as possible. And anything init does might fail, so the less the does the better, so just start a shell. Anything a script can do a human admin can do, so having no setup scripts would be safer. In this case, the next step is looking at the source code for init, finding where it mounts root in read-only, modify the source code, recompile and install.
You understand that if you screw this up, you will reinstall, right? Matter-of-fact, given how you are removing all the safety rails on the system, you will reinstall pretty soon anyway, so going on a voyage of discovery is a wonderful justification for reinstalling.