Nonce for AES GCM to prevent replay attacks
Any of the ways you listed would work.

If you're collecting alternatives, yet another one (which I have seen in practice) is to include the message counter as the AAD (additional authenticated data), which is another input to GCM.

When we consider which one would be the best, we note that GCM has absolutely no requirement that the nonce be "random", or for that matter, unpredictable.  So, there is no particular reason you couldn't use 4 of the bytes (or, for that matter, all 12 bytes) as a counter; given that all the options on the table are secure, this option (which is the cheapest) would appear to be the best.