I created an SSO-enrolled PAT with read:org and repo:* capabilities, and gh seemed happy with it:

$ export GITHUB_TOKEN=ghp_XXX
$ gh auth status
github.com
 ✓ Logged in to github.com as adonovan (GITHUB_TOKEN)
 ✓ Git operations for github.com configured to use https protocol.
 ✓ Token: *******************

But the cs list command fails like so:

$ gh cs list
error getting codespaces: Must have admin rights to Repository. 

@issyl0 suggested running:

$ gh auth refresh -s codespace -h github.com 

and going through the ssh -> OAuth flow, and this did indeed solve the problem. (Thanks!)

However, the error message from cs list could be more specific about the underlying cause and the solution.
In particular:

• there is nothing called "admin rights to Repository" in the PAT capabilities UI.
• I had no idea the solution was not to use a PAT in the environment, but to use the auth subcommand to create an oauth token in a file.

I can imagine finding myself confused again if I ever run gh in an environment that has GITHUB_TOKEN set.