For say the ‘moomin’ post type, when defining the custom post type specify its ‘capability_type’ as ‘moomin’.
This will give you the ‘capabilities’ edit_moomin’ etc which you can then remove from individual roles, e.g.:
global $wp_roles;
// remove capability edit_moomin from role editor
$wp_roles->remove_cap( 'editor', 'edit_moomin' );
@Simon Forster claims readonly posts IS possible, if so then this should do the job:
$wp_roles->add_cap( 'editor', 'read_moomin' );