Choice between appending or prepending nonces to ciphertexts
The order of the tag, the nonce and the ciphertext doesn't matter at all. Any encoding would perfectly fine, since what gets authenticated is the data itself and not the way it is encoded for transport.

Now, if you can't use counters, and you don't trust the PRG, you may end up reusing nonces, no matter how they are encoded.

You should either use a nonce-misuse resistant scheme such as AES-GCM-SIV, or use a KDF to create the nonce from the ciphertext, some output from the PRG, and a secondary key.