A retail company must extend its on-premises PCI DSS cardholder data environment (CDE) to an AWS region hosting a payment processing application. Regulatory auditors require that cardholder data in transit never traverse the public internet, that the link provide predictable, dedicated bandwidth for consistent transaction latency, and that all traffic be encrypted end-to-end. The company already has a colocation presence at a carrier-neutral facility where AWS offers a physical cross-connect. Which connectivity model best satisfies these requirements?