Based on experience, I have to copy out the hsm_secret and use this tool to capture the xpub
You are the first to ever ask for this, curious what your use case is.
I believe this can be done from the CLI using dumponchaindescriptors command.
You'll need to SSH into the server and access the CLN container.
https://docs.start9.com/0.3.5.x/user-manual/container-access
Based on experience, I have to copy out the hsm_secret and use this tool to capture the xpub