You can get the "evaluation" copies of CE 6 and 7, including source code (it will ask you to accept the "Shared Source" license; it's pretty straightforward and fairly permissive).
http://www.microsoft.com/windowsembedded/en-us/downloads/download-windows-embedded-compact-ce.aspx (link for 6.0 is in the upper left).
I think the "user-mode kernel" option requires writing a "hardware abstraction layer" that talks to the host kernel, and I'm not sure anybody has done that here, so maybe that's not practical. On the other hand, like I said, it depends on which and how many kernel-mode APIs it needs to call. Aside from memory management, which I think shouldn't be too hard, there's also the question of whether any custom interrupt handlers are needed, and how to trap them. If the amount of stuff that *must* be done in ring 0 is small enough, a driver that does it for you is possible.
Alternatively, you could have a driver that essentially *is* HaRET, and the UI would just be a usermode program that calls into this driver. I don't know how much or how little re-writing that would take; I'd need to look at the HaRET sources and architecture more to know. It wouldn't be trivial work, but it would allow calling kernel APIs without interference...
HtcUtiltity.dll is a driver that HTC ships on their Windows phones, presumably for debug purposes, which exposes an IOCTL that can read or write 4 bytes at a time from any kernel-mapped address. The HtcRoot project uses this to dump the kernel's process metadata structs, modify the security info, and write the modified data back into the kernel. That's not really what you need to do, I think, but HtcUtility could be used other ways too. For example, override the kernel-mode side of the system call function table, so that *after* the thunk to ring0, the kernel jumps to code you control (arbitrary code execution in kernel).
As for what is required for a ROM to support HtcUtility, it's a matter of which stock firmware image a given ROM's copy of the DLL (would be a .SYS on NT, probably, though that's just convention without real meaning) comes from. Most HTC ROMs include working (meaning older) versions of the HtcFileUtility and HtcProvisionDrv DLLs, because those have had known uses for a year or so now. The power of HtcUtility was only recently discovered, though. There's a list on the HtcRoot project thread of compatible and incompatible versions; it's nowhere near comprehensive but may be enough to get started.