A retail company runs a set of microservices on managed instance groups spread across three zones in the us-central1 region. Internal clients within the same VPC need to reach these services using host- and path-based routing (for example, /cart and /checkout map to different backends). All traffic must stay private (RFC 1918) and must never traverse the public internet. Which load-balancing option should the network architect select?